Information Exposure Affecting ansible package, versions [,2.6.19) [2.7.0, 2.7.13) [2.8.0, 2.8.4)
Snyk CVSS
Attack Complexity
High
User Interaction
Required
Confidentiality
High
Integrity
High
Threat Intelligence
EPSS
0.22% (60th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-ANSIBLE-535490
- published 24 Nov 2019
- disclosed 24 Jul 2019
- credit Paul Rubin
Introduced: 24 Jul 2019
CVE-2019-10206 Open this link in a new tabHow to fix?
Upgrade ansible to version 2.6.19, 2.7.13, 2.8.4 or higher.
Overview
ansible is a simple IT automation system.
Affected versions of this package are vulnerable to Information Exposure. It prompted passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.