A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.
References
| Link | Resource |
|---|---|
| https://access.redhat.com/errata/RHSA-2019:3744 | Vendor Advisory |
| https://access.redhat.com/errata/RHSA-2019:3789 | Vendor Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10156 | Issue Tracking Vendor Advisory |
| https://github.com/ansible/ansible/pull/57188 | Patch Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html | Vendor Advisory |
| https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html | Mailing List Third Party Advisory |
| https://www.debian.org/security/2021/dsa-4950 | Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
19 Apr 2022, 15:36
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | |
| References |
|
07 Aug 2021, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:redhat:openstack:14.0:*:*:*:*:*:*:* |
cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* |
Information
Published : 2019-07-30 23:15
Updated : 2024-02-04 20:20
NVD link : CVE-2019-10156
Mitre link : CVE-2019-10156
CVE.ORG link : CVE-2019-10156
JSON object : View
Products Affected
debian
- debian_linux
redhat
- ansible
- openstack
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor