CVE-2020-14332

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-09-11 · updated 2026-06-17
Weakness: CWE-117

Description

A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.

Affected products

Debian Linux: 10.0
RedHat Ansible Engine: from 2.8.0 before 2.8.14; from 2.9.0 before 2.9.12 — fixed in 2.8.14, 2.9.12

How to fix

Upgrade to a fixed version: RedHat Ansible Engine 2.8.14, 2.9.12. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14332
https://github.com/ansible/ansible/pull/71033
https://www.debian.org/security/2021/dsa-4950
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14332
https://github.com/ansible/ansible/pull/71033
https://www.debian.org/security/2021/dsa-4950

Get alerted when CVE-2020-14332 or the next vulnerability affects your stack