Red Hat · Ansible · CVE-2019-14864
**Name of the Vulnerable Software and Affected Versions**
Ansible versions 2.7.x through 2.7.14
Ansible versions 2.8.x through 2.8.6
Ansible versions 2.9.x through 2.9.0
**Description**
The issue is related to the absence of consideration for the `no log` flag in Ansible's system management configuration modules for Splunk and Sumologic. This could allow a remote attacker to gain unauthorized access to protected information. The vulnerability affects Ansible when using Sumologic and Splunk callback plugins, causing the disclosure and collection of sensitive data when the `no log` flag is set to True.
**Recommendations**
For Ansible versions 2.7.x through 2.7.14, update to version 2.7.15 or later to resolve the issue.
For Ansible versions 2.8.x through 2.8.6, update to version 2.8.7 or later to resolve the issue.
For Ansible versions 2.9.x through 2.9.0, update to version 2.9.1 or later to resolve the issue.