Bug 1764148 (CVE-2019-14864)
| Summary: | CVE-2019-14864 Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Borja Tarraso <btarraso> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | a.badger, dajohnso, dbecker, dmetzger, gblomqui, gmainwar, gmccullo, gtanzill, hvyas, jcammara, jfrey, jhardy, jjoyce, jlaska, jprause, jschluet, jtanner, kbasil, kdixon, kevin, lhh, lpeer, mattdavi, maxim, mburns, obarenbo, puebele, rhos-maint, roliveri, sclewis, security-response-team, simaishi, sisharma, slinaber, tkuratom, tvignaud, vbellur |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ansible-engine 2.9.1, ansible-engine 2.8.7, ansible-engine 2.7.15 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A data disclosure flaw was found in Ansible when using the Splunk and Sumologic modules, as they are not respecting when the flag no_log is enabled. This flaw can disclose and collect sensitive data from the system and expose it to an attacker.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-11-20 18:51:41 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1764188, 1764190, 1764191, 1769192, 1773470, 1774003, 1774004, 1774005, 1774007 | ||
| Bug Blocks: | 1764140 | ||
|
Description
Borja Tarraso
2019-10-22 11:19:50 UTC
Upstream issue: https://github.com/ansible/ansible/issues/63522 Upstream fix: https://github.com/ansible/ansible/pull/63527 Acknowledgments: Name: Abhijeet Kasurde (Red Hat), Patrick O’Brien (The Trade Desk Inc) Created ansible tracking bugs for this issue: Affects: epel-6 [bug 1774003] Affects: epel-7 [bug 1774004] Affects: fedora-all [bug 1774005] Affects: openstack-rdo [bug 1774007] This issue has been addressed in the following products: Red Hat Ansible Engine 2.7 for RHEL 7 Via RHSA-2019:3925 https://access.redhat.com/errata/RHSA-2019:3925 This issue has been addressed in the following products: Red Hat Ansible Engine 2 for RHEL 7 Red Hat Ansible Engine 2 for RHEL 8 Via RHSA-2019:3928 https://access.redhat.com/errata/RHSA-2019:3928 This issue has been addressed in the following products: Red Hat Ansible Engine 2.9 for RHEL 7 Red Hat Ansible Engine 2.9 for RHEL 8 Via RHSA-2019:3927 https://access.redhat.com/errata/RHSA-2019:3927 This issue has been addressed in the following products: Red Hat Ansible Engine 2.8 for RHEL 7 Red Hat Ansible Engine 2.8 for RHEL 8 Via RHSA-2019:3926 https://access.redhat.com/errata/RHSA-2019:3926 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2019-14864 Statement: * The exploitation of this flaw depends on the use of either Sumo Logic or Splunk callback plugins. However, because Red Hat OpenStack Platform (RHOSP) does not use Sumo Logic or Splunk, Red Hat will not be providing a fix for RHOSP Ansible at this time. * Red Hat Gluster Storage no more maintains its own version of Ansible, pre-requisite is to enable ansible repository. The fix will be consumed from core Ansible. * Ansible Tower’s Splunk logging integration uses the Splunk HTTP Collector and Ansible Engine. * The exploitation of this flaw depends on the use of either Sumo Logic or Splunk callback plugins. However, because Red Hat Satellite 6.4 and 6.5 do not use Sumo Logic or Splunk, Red Hat will not be providing a fix for Satellite 6.4 and 6.5 and Ansible at this time. Users may upgrade to Satellite 6.6 or later which includes the resolution to this bug if desired. Red Hat CloudForms 5.10 (4.7) and 5.11 (5.0) do not ship `ansible` package, it is provided by the official Ansible repository. |