Vulnerabilities in pkg:pypi/ansible

Q: What is CVE-2025-14010?

CVE-2025-14010 is a security vulnerability in Ansible involving Ansible Community General Collection is vulnerable to exposure of sensitive information under CWE-532: Insertion of Sensitive Information into Log File.

Q: Which Ansible versions are affected?

Affected versions include releases prior to 12.2.0 across affected packages: ansible.

Q: What version fixes CVE-2025-14010?

Upgrading to 12.2.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is ansible affected?

Yes, ansible is affected in releases prior to 12.2.0. Upgrade your dependency to 12.2.0 or later.

Q: What is the CVSS score of CVE-2025-14010?

CVE-2025-14010 has a CVSS v3.1 base score of 5.5 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Q: What CWE is associated with CVE-2025-14010?

CVE-2025-14010 is classified under CWE-532: Insertion of Sensitive Information into Log File (The product writes sensitive information to a log file.).

Q: How can I check PyPI dependencies for CVE-2025-14010?

Run the dependency tree command: 'pip show ansible'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

PACKAGE

Advisory Identifier: GHSA-8ggh-xwr9-3373

Advisory Summary

CVE-2025-14010 is a MODERATE (CVSS 5.5) ansible community general collection is vulnerability (CWE-532: Insertion of Sensitive Information into Log File) affecting Ansible libraries in the PyPI ecosystem. The issue involves ansible community general collection is vulnerable to exposure of sensitive information. Remediation is available by upgrading affected packages to version 12.2.0.

66 Known Advisory Record(s)

Package Vulnerability Intelligence

pkg:pypi/ansible

66 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:pypi/ansible. Select an advisory below to view technical details or fixes.

Advisory ID	CVE / NVD	Severity	Summary
GHSA-8ggh-xwr9-3373	CVE-2025-14010	MODERATE	Ansible Community General Collection is vulnerable to exposure of sensitive information
GHSA-f556-49jc-4rvc	CVE-2020-25635	MODERATE	Ansible does not collect garbage after playbook run
GHSA-w578-j992-554x	CVE-2017-7481	CRITICAL	Ansible fails to properly mark lookup-plugin results as unsafe
GHSA-jpvw-p8pr-9g2x	CVE-2023-5115	MODERATE	Ansible symlink attack vulnerability
GHSA-6fq2-x65v-v9h7	CVE-2019-14856	HIGH	Ansible password prompts could expose passwords
GHSA-cqmr-rcpr-cxh3	CVE-2019-10206	HIGH	Ansible password prompts could expose passwords
GHSA-j569-fghw-f9rx	CVE-2018-16876	HIGH	Ansible sensitive information disclosure
GHSA-p75j-wc34-527c	CVE-2019-10217	HIGH	Exposure of Sensitive Information to an Unauthorized Actor in ansible
GHSA-wv5p-gmmv-wh9v	CVE-2021-20178	HIGH	Insertion of Sensitive Information into Log File in ansible
GHSA-g4mq-6fp5-qwcf	CVE-2020-1733	LOW	Ansible vulnerable to Exposure of Resource to Wrong Sphere and Insecure Temporary File
GHSA-x7jh-595q-wq82	CVE-2020-1736	MODERATE	Incorrect Permission Assignment for Critical Resource in Ansible
GHSA-m429-fhmv-c6q2	CVE-2020-14365	MODERATE	Improper Verification of Cryptographic Signature in ansible
GHSA-frxj-5j27-f8rf	CVE-2019-14905	HIGH	Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible
GHSA-p62g-jhg6-v3rq	CVE-2020-10684	MODERATE	Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible
GHSA-vp9j-rghq-8jhh	CVE-2020-10744	LOW	Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
GHSA-m956-frf4-m2wr	CVE-2016-9587	CRITICAL	Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems
GHSA-jwcc-j78w-j73w	CVE-2018-10855	HIGH	Ansible exposes sensitive data in log files and on the terminal
GHSA-9x6q-5423-w5v9	CVE-2013-2233	CRITICAL	Ansible fails to cache SSH host keys
GHSA-74vq-h4q8-x6jv	CVE-2019-3828	LOW	Ansible Path Traversal vulnerability
GHSA-j2h6-73x8-22c4	CVE-2020-1746	MODERATE	Exposure of Sensitive Information to an Unauthorized Actor in ansible
GHSA-h39q-95q5-9jfp	CVE-2020-1734	HIGH	OS Command Injection in ansible
GHSA-66c7-5pwv-mm3j	CVE-2014-4678	CRITICAL	Ansible Code Injection Vulnerability
GHSA-5xm4-jmpw-p6j3	CVE-2014-4660	MODERATE	Ansible discloses credential information
GHSA-6667-f46p-pg88	CVE-2014-4659	MODERATE	Ansible sets unsafe permissions for sources.list
GHSA-64cw-m57j-65xj	CVE-2014-4967	CRITICAL	Ansible Arbitrary Code Execution
GHSA-wqq5-c89p-3wc3	CVE-2014-4966	CRITICAL	Ansible Arbitrary Code Execution
GHSA-h653-95qw-h2mp	CVE-2019-14858	MODERATE	Ansible leaks sensitive information to logs when told not to
GHSA-8f4m-hccc-8qph	CVE-2021-20191	MODERATE	Insertion of Sensitive Information into Log File in ansible
GHSA-r6h7-5pq2-j77h	CVE-2020-10729	MODERATE	Insufficiently random values in Ansible
GHSA-86hp-cj9j-33vv	CVE-2020-1753	MODERATE	Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and Exposure of Sensitive Information to an Unauthorized Actor in Ansible
GHSA-gfr2-qpxh-qj9m	CVE-2020-1735	MODERATE	Path Traversal in Ansible
GHSA-5rrg-rr89-x9mv	CVE-2021-20228	HIGH	Ansible Exposes Sensitive Information
GHSA-pm48-cvv2-29q5	CVE-2019-14846	HIGH	Ansible Uses Plugins That Disclose Credentials
GHSA-4r65-35qq-ch8j	CVE-2021-3620	MODERATE	Ansible discloses sensitive information in traceback error message
GHSA-3xvg-x47j-x75w	CVE-2018-10874	HIGH	Ansible Improper Input Validation vulnerability
GHSA-qg47-5px9-32g7	CVE-2014-4657	CRITICAL	Ansible Remote Code Execution
GHSA-77g3-3j5w-64w4	CVE-2020-10685	MODERATE	Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
GHSA-gwr8-5j83-483c	CVE-2019-14904	HIGH	OS Command Injection and Improper Input Validation in ansible
GHSA-49m5-2838-q2rv	CVE-2014-2686	HIGH	Ansible unsafe evaluation of some strings
GHSA-f85h-23mf-2fwh	CVE-2020-1738	LOW	Argument Injection in Ansible
GHSA-893h-35v4-mxqx	CVE-2020-1737	HIGH	Path Traversal in Ansible
GHSA-923p-fr2c-g5m2	CVE-2020-1739	LOW	Exposure of Sensitive Information to an Unauthorized Actor in Ansible
GHSA-2pfh-q76x-gwvm	CVE-2021-3583	HIGH	Improper Input Validation and Command Injection in Ansible
GHSA-5g4v-2pc6-4hh4	CVE-2014-4658	MODERATE	Ansible Sensitive Files Are Locally Readable
GHSA-785x-qw4v-6872	CVE-2020-14330	MODERATE	Improper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansible
GHSA-fc4h-467w-46rh	CVE-2018-10875	HIGH	Ansible Arbitrary Code Execution
GHSA-j667-c2hm-f2wp	CVE-2020-14332	MODERATE	Insertion of Sensitive Information into Log File and Improper Output Neutralization for Logs in ansible
GHSA-3c67-gc48-983w	CVE-2020-10691	MODERATE	Path Traversal in Ansible
GHSA-grgm-pph5-j5h7	CVE-2019-10156	MODERATE	Exposure of Sensitive Information to an Unauthorized Actor in ansible
GHSA-vcg8-98q8-g7mj	CVE-2020-1740	MODERATE	Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible
GHSA-3m93-m4q6-mc6v	CVE-2019-14864	MODERATE	Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in Ansible
GHSA-588w-w6mv-3cw5	CVE-2017-7550	CRITICAL	Ansible Insertion of Sensitive Information into Log File vulnerability
GHSA-pcqv-c46v-2p4v	CVE-2013-4260	MODERATE	Ansible Arbitrary File Overwrite Vulnerability
GHSA-fj24-ghp9-39v3	CVE-2013-4259	LOW	Ansible uses a socket with predictable filename in /tmp
GHSA-v735-2pp6-h86r	CVE-2018-16859	MODERATE	Ansible Logs Passwords If PowerShell ScriptBlock is Enabled
GHSA-hwrm-63v2-42g4	CVE-2018-16837	HIGH	Ansible Leaks Data Passed to ssh-keygen
GHSA-jg4f-jqm5-4mgq	CVE-2016-8628	CRITICAL	Ansible fails to properly sanitize fact variables sent from the Ansible controller
GHSA-rh6x-qvg7-rrmj	CVE-2016-3096	HIGH	Link Following in ansible
GHSA-w64c-pxjj-h866	CVE-2015-3908	HIGH	Ansible does not verify that the server hostname matches a domain name in certificates
GHSA-cmwx-9m2h-x7v4	CVE-2016-8614	HIGH	Ansible apt_key module does not properly verify key fingerprint
GHSA-3m8p-xpm6-8ww3	CVE-2017-7466	HIGH	Ansible Arbitrary Code Execution
GHSA-4cvm-5776-jx9f	CVE-2014-3498	HIGH	Ansible Arbitrary Code Execution
GHSA-x4cm-m36h-c6qj	CVE-2016-8647	MODERATE	Improper Input Validation in ansible
GHSA-wwwh-47wp-m522	CVE-2015-6240	HIGH	Ansible Sandbox Escape via Symlink Attack
GHSA-cpx3-93w7-457x	CVE-2022-3697	HIGH	Ansible leaks password to logs
GHSA-fh5v-5f35-2rv2	CVE-2021-20180	MODERATE	Insertion of Sensitive Information into Log File in ansible

CVE-2025-14010 at a Glance

CVE Identifier CVE-2025-14010

GHSA Identifier GHSA-8ggh-xwr9-3373

Severity MODERATE

CVSS v3.1 Base Score 5.5

CWE Classification CWE-532: Insertion of Sensitive Information into Log File

Affected Product Ansible

Package Ecosystem PyPI

Published Date 2025-12-04

Last Updated 2025-12-05

Security Impact

CVSS: 5.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Attack Vector Local (AV:L)

Attack Complexity Low (AC:L)

Privileges Required Low (PR:L)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity None (I:N)

Availability None (A:N)

How to Fix CVE-2025-14010

To remediate this vulnerability, upgrade all affected Ansible dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

ansible fixed: 12.2.0

pip install ansible>=12.2.0

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

pip show ansible

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2025-14010, inspect your installed packages using pip:

pip show ansible

Analyze the terminal output to locate any version of Ansible in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 12.2.0), your application is affected.

Note: The pip show ansible command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-532: Insertion of Sensitive Information into Log File, where the product writes sensitive information to a log file. In Ansible, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.

CVE-2025-14010 Affected Ansible Versions

1 component(s)

Fixed Versions:

12.2.0

Product / Package	Ecosystem	Affected Versions	Fixed Version
ansible pypi/ansible	PyPI	< 12.2.0	12.2.0

References

NVD — CVE-2025-14010 NVD

https://nvd.nist.gov/vuln/detail/CVE-2025-14010

Ansible Source Repository REPOSITORY

https://github.com/ansible-collections/community.general/issues/11000

Security Fix Commit FIX COMMIT

https://github.com/ansible-collections/community.general/commit/08e56bbb9b57740a879d3057d84cdb02a162b840

Ansible Security Information SECURITY

https://access.redhat.com/security/cve/CVE-2025-14010

bugzilla.redhat.com/show_bug.cgi WEB

https://bugzilla.redhat.com/show_bug.cgi?id=2418774

Ansible Source Repository REPOSITORY

https://github.com/ansible-collections/community.general

Ansible Source Repository REPOSITORY

https://github.com/ansible-community/ansible-build-data/blob/12.2.0/12/CHANGELOG-v12.md#security-fixes

Frequently Asked Questions

What is CVE-2025-14010?

CVE-2025-14010 is a security vulnerability in Ansible involving Ansible Community General Collection is vulnerable to exposure of sensitive information under CWE-532: Insertion of Sensitive Information into Log File.

Which Ansible versions are affected?

Affected versions include releases prior to 12.2.0 across affected packages: ansible.

What version fixes CVE-2025-14010?

Upgrading to 12.2.0 (or the latest patched release for your respective branch) resolves the vulnerability.

Is ansible affected?

Yes, ansible is affected in releases prior to 12.2.0. Upgrade your dependency to 12.2.0 or later.

What is the CVSS score of CVE-2025-14010?

CVE-2025-14010 has a CVSS v3.1 base score of 5.5 (MODERATE) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

What CWE is associated with CVE-2025-14010?

CVE-2025-14010 is classified under CWE-532: Insertion of Sensitive Information into Log File (The product writes sensitive information to a log file.).

How can I check PyPI dependencies for CVE-2025-14010?

Run the dependency tree command: 'pip show ansible'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-8ggh-xwr9-3373",
  "modified" : "2025-12-05T21:19:33Z",
  "published" : "2025-12-04T12:31:05Z",
  "aliases" : [ "CVE-2025-14010" ],
  "summary" : "Ansible Community General Collection is vulnerable to exposure of sensitive information",
  "details" : "A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaintext passwords, via verbose output when running Ansible with debug modes. Attackers with access to logs could retrieve these secrets and potentially compromise Keycloak accounts or administrative access.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "ansible"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "12.2.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-14010"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ansible-collections/community.general/issues/11000"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ansible-collections/community.general/commit/08e56bbb9b57740a879d3057d84cdb02a162b840"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/CVE-2025-14010"
  }, {
    "type" : "WEB",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2418774"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/ansible-collections/community.general"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/ansible-community/ansible-build-data/blob/12.2.0/12/CHANGELOG-v12.md#security-fixes"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200", "CWE-532" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-12-05T02:15:35Z",
    "nvd_published_at" : "2025-12-04T10:16:00Z"
  }
}

CVSS V3

5.5 MODERATE

Attack Vector Local (AV:L)

Attack Complexity Low (AC:L)

Privileges Required Low (PR:L)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity None (I:N)

Availability None (A:N)

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Advisory Metadata

Source ID: GHSA-8ggh-xwr9-3373
Schema Version: 1.4.0
Published: 2025-12-04 12:31
Last Modified: 2025-12-05 21:19
Database Record File: advisories/github-reviewed/2025/12/GHSA-8ggh-xwr9-3373/GHSA-8ggh-xwr9-3373.json