CVE-2019-10217: Sensitive Information Exposure in ansible
Summary
CVE-2019-10217: Exposure of Sensitive Information to an Unauthorized Actor in ansible. Affects ansible versions >= 2.8.0a1, < 2.8.4. Fixed in 2.8.4. How to fix ↓
Also tracked for
- ansible · Alpine:v3.10
The same CVE-2019-10217 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT infrastructure tasks. It is widely used for configuration management, application deployment, and orchestration. Ansible relies on playbooks, which are YAML files that define a set of tasks to be executed on remote hosts. These playbooks can contain sensitive information such as passwords, API keys, and private keys.
Vulnerability Detail
The vulnerability identified as CVE-2019-10217 affects ansible versions 2.8.0 to 2.8.4. The issue arises from the improper handling of sensitive data in the GCP (Google Cloud Platform) modules. Specifically, the 'service_account_contents()' function, which is a common class for all GCP modules, fails to set the 'no_log' feature to true. As a result, any sensitive data managed by this function can be leaked as an output when running ansible playbooks. This vulnerability poses a moderate risk as it could expose sensitive information to unauthorized actors, potentially leading to unauthorized access or data breaches.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.8.4
This is the first release that contains the fix.
pip install --upgrade "ansible==2.8.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually modify the affected GCP modules to set the 'no_log' feature to true for the relevant fields. Here is an example of how to modify the 'service_account_contents()' function:
# Original code
def service_account_contents():
# ... original implementation ...
return sensitive_data
# Modified code
def service_account_contents():
# ... original implementation ...
sensitive_data.no_log = True
return sensitive_data
Conclusion
In conclusion, the vulnerability CVE-2019-10217 exposes sensitive information in ansible due to improper handling of data in the GCP modules. Users are advised to upgrade to ansible version 2.8.4 or later to mitigate this issue. Alternatively, a workaround is available by manually modifying the affected modules. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration. It allows users to define tasks in YAML files called playbooks and execute them on remote hosts.
This vulnerability could expose sensitive information managed by ansible, such as passwords, API keys, and private keys. Unauthorized actors could potentially access this information, leading to unauthorized access or data breaches.
Versions 2.8.0 to 2.8.4 of ansible are affected by this vulnerability.
To fix this vulnerability, upgrade your ansible installation to version 2.8.4 or later. This ensures that the 'no_log' feature is properly set for sensitive data in the GCP modules.
Yes, as a workaround, you can manually modify the affected GCP modules to set the 'no_log' feature to true for the relevant fields. Refer to the provided code example for guidance.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
