CVE-2019-10156

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Red Hat	ansible	fixed in 2.6.18; fixed in 2.7.12; fixed in 2.8.2

References

https://access.redhat.com/errata/RHSA-2019:3744Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:3789Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10156Issue Tracking, Vendor Advisory
https://github.com/ansible/ansible/pull/57188Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00016.htmlVendor Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00023.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2021/dsa-4950Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3744Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:3789Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10156Issue Tracking, Vendor Advisory
https://github.com/ansible/ansible/pull/57188Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/09/msg00016.htmlVendor Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00023.htmlMailing List, Third Party Advisory
https://www.debian.org/security/2021/dsa-4950Third Party Advisory

Timeline

Published: Jul 30, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101575.5It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its back CVE-2019-101589.8A flaw was found in Infinispan through version 9.4.14.Final. An improper implementation of the session fixation protection in the Spring Ses CVE-2019-101594.3cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration CVE-2019-10164.7An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory. An attacker w CVE-2019-101609.8A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7 CVE-2019-101617.8It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() AP CVE-2019-101627.5A vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.10, 4.0.8 allowing an authorized user to cause the serve CVE-2019-101634.3A Vulnerability has been found in PowerDNS Authoritative Server before versions 4.1.9, 4.0.8 allowing a remote, authorized master server to CVE-2019-101648.8PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user c CVE-2019-101652.3OpenShift Container Platform before version 4.1.3 writes OAuth tokens in plaintext to the audit logs for the Kubernetes API server and OpenS CVE-2019-101667.8It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainMana CVE-2019-101677.8The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to