CVE-2019-14858

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-117 CWE-532

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-148599.1A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without CVE-2019-14866.1A spoofing vulnerability exists in Visual Studio Live Share when a guest connected to a Live Share session is redirected to an arbitrary URL CVE-2019-148606.5It was found that the Syndesis configuration for Cross-Origin Resource Sharing was set to allow all origins. An attacker could use this lack CVE-2019-148615.3All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the (poorly named) dnsserver RPC CVE-2019-148626.1There is a vulnerability in knockout before version 3.5.0-beta, where after escaping the context of the web application, the web application CVE-2019-148636.1There is a vulnerability in all angular versions before 1.5.0-beta.0, where after escaping the context of the web application, the web appli CVE-2019-148646.5Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it CVE-2019-148655.9A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by CVE-2019-148667.3In all versions of cpio before 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR arc CVE-2019-148678.8A flaw was found in IPA, all 4.6.x versions before 4.6.7, all 4.7.x versions before 4.7.4 and all 4.8.x versions before 4.8.3, in the way th CVE-2019-148687.8In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override CVE-2019-148698.8A flaw was found in all versions of ghostscript 9.x before 9.50, where the `.charkeys` procedure, where it did not properly secure its privi