CVE-2019-10217

NameCVE-2019-10217
DescriptionA flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs934128

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ansible (PTS)jessie, jessie (lts)1.7.2+dfsg-2+deb8u3fixed
stretch (security), stretch (lts), stretch2.2.1.0-2+deb9u3fixed
buster (security), buster, buster (lts)2.7.7+dfsg-1+deb10u2fixed
bullseye2.10.7+merged+base+2.10.17+dfsg-0+deb11u1fixed
bookworm7.7.0+dfsg-3+deb12u1fixed
sid, trixie10.6.0+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ansiblesourcewheezy(unfixed)end-of-life
ansiblesourcejessie(not affected)
ansiblesourcestretch(not affected)
ansiblesourcebuster(not affected)
ansiblesource(unstable)2.8.6+dfsg-1934128

Notes

[buster] - ansible <not-affected> (Vulnerable code introduced later)
[stretch] - ansible <not-affected> (Vulnerable code introduced later)
[jessie] - ansible <not-affected> (vulnerable code introduced later)
https://github.com/ansible/ansible/issues/56269
https://github.com/ansible/ansible/pull/59427
Introduced by: https://github.com/ansible/ansible/commit/08918c6c2bcd73eb40b89af31736d3fcbe55e75a (v2.8.0a1)
Fixed by: https://github.com/ansible/ansible/commit/c1ee1f142db1e669b710a65147ea32be47a91519

Search for package or bug name: Reporting problems