CVE-2019-10206

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-522

Affected software

Vendor	Product	Versions
Red Hat	Ansible	all 2.8.x before 2.8.4; all 2.7.x before 2.7.13; all 2.6.x before 2.6.19

References

http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.htmlMailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10206Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
https://www.debian.org/security/2021/dsa-4950Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.htmlMailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.htmlMailing List, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10206Issue Tracking, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
https://www.debian.org/security/2021/dsa-4950Third Party Advisory

Timeline

Published: Nov 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-102075.5A flaw was found in the Linux kernel's Bluetooth implementation of UART, all versions kernel 3.x.x before 4.18.0 and kernel 5.x.x. An attack CVE-2019-102088.8A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x befor CVE-2019-102092.2Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.CVE-2019-10217.8An elevation of privilege exists in Windows Audio Service. An attacker who successfully exploited the vulnerability could run arbitrary code CVE-2019-102107.0Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected CVE-2019-102119.8Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unpro CVE-2019-102129.8A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security. If enabled, an attacker could abuse this CVE-2019-102136.5OpenShift Container Platform, versions 4.1 and 4.2, does not sanitize secret data written to pod logs when the log level in a given operator CVE-2019-102145.9The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in Open CVE-2019-102156.1Bootstrap-3-Typeahead after version 4.0.2 is vulnerable to a cross-site scripting flaw in the highlighter() function. An attacker could expl CVE-2019-102167.8In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSA CVE-2019-102176.5A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields