CVE-2020-14332

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-117 CWE-532

Affected software

Vendor	Product	Versions
Red Hat	Ansible	2.9.12; 2.8.14

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14332Issue Tracking, Vendor Advisory
https://github.com/ansible/ansible/pull/71033Patch, Third Party Advisory
https://www.debian.org/security/2021/dsa-4950Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14332Issue Tracking, Vendor Advisory
https://github.com/ansible/ansible/pull/71033Patch, Third Party Advisory
https://www.debian.org/security/2021/dsa-4950Third Party Advisory

Timeline

Published: Sep 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-143336.1A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not filter user-controllable parameters completely, CVE-2020-143348.8A flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files. These cache credentials could help attacker to CVE-2020-143355.5A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This fl CVE-2020-143366.5A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allow CVE-2020-143375.8A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthentic CVE-2020-143385.3A flaw was found in Wildfly's implementation of Xerces, specifically in the way the XMLSchemaValidator class in the JAXP component of Wildfl CVE-2020-143398.8A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows CVE-2020-14345.3An elevation of privilege vulnerability exists in the way that the Windows Sync Host Service handles objects in memory, aka 'Windows Sync Ho CVE-2020-143405.9A vulnerability was discovered in XNIO where file descriptor leak caused by growing amounts of NIO Selector file handles between garbage col CVE-2020-143412.7The "Test Connection" available in v7.x of the Red Hat Single Sign On application console can permit an authorized user to cause SMTP connec CVE-2020-143427.0It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary co CVE-2020-143439.8A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it pro