CVE-2019-10206

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.

Weakness

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Affected Software

Name	Vendor	Start Version	End Version
Ansible	Redhat	2.6.0 (including)	2.6.19 (excluding)
Ansible	Redhat	2.7.0 (including)	2.7.13 (excluding)
Ansible	Redhat	2.8.0 (including)	2.8.4 (excluding)
Red Hat Ansible Engine 2.6 for RHEL 7	RedHat	ansible-0:2.6.19-1.el7ae	*
Red Hat Ansible Engine 2.7 for RHEL 7	RedHat	ansible-0:2.7.13-1.el7ae	*
Red Hat Ansible Engine 2.8 for RHEL 7	RedHat	ansible-0:2.8.4-1.el7ae	*
Red Hat Ansible Engine 2.8 for RHEL 8	RedHat	ansible-0:2.8.4-1.el8ae	*
Red Hat Ansible Engine 2 for RHEL 7	RedHat	ansible-0:2.8.4-1.el7ae	*
Red Hat Ansible Engine 2 for RHEL 8	RedHat	ansible-0:2.8.4-1.el8ae	*
Red Hat OpenStack Platform 13.0 (Queens)	RedHat	ansible-0:2.6.19-1.el7ae	*
Red Hat OpenStack Platform 14.0 (Rocky)	RedHat	ansible-0:2.6.19-1.el7ae	*
Ansible	Ubuntu	bionic	*
Ansible	Ubuntu	disco	*
Ansible	Ubuntu	eoan	*
Ansible	Ubuntu	esm-apps/bionic	*
Ansible	Ubuntu	esm-apps/xenial	*
Ansible	Ubuntu	trusty	*
Ansible	Ubuntu	trusty/esm	*
Ansible	Ubuntu	upstream	*
Ansible	Ubuntu	xenial	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2019-10206
CWE	https://cwe.mitre.org/data/definitions/522.html

Insufficiently Protected Credentials

Weakness

Affected Software

Potential Mitigations

References

CVE-2019-10206

Insufficiently Protected Credentials

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References