CVE-2019-14846: Inclusion of Sensitive Information in Log Files

October 8, 2019 (updated October 21, 2019)

Ansible is logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14846
nvd.nist.gov/vuln/detail/CVE-2019-14846

Code Behaviors & Features

Detect and mitigate CVE-2019-14846 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →