diff options
| author | Matt Davis <nitzmahone@users.noreply.github.com> | 2019-11-12 17:03:31 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-11-12 17:03:31 -0800 |
| commit | 75288a89d0053d6df35c90863fb6c9542d89850e (patch) | |
| tree | b5ad4831bf451cd5f682ac233dea148ff9f2a28d | |
| parent | ab910e1f5a12fbf028d4d70d28dd7ec36427e602 (diff) | |
| download | ansible-75288a89d0053d6df35c90863fb6c9542d89850e.tar.gz | |
Callback: removing args from task_fields from Sumologic and Splunk plugin(#63527) (#64748)
CVE-2019-14864 Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs
Fixes #63522
Signed-off-by: Patrick O’Brien <patrick.obrien@thetradedesk.com>
Signed-off-by: Abhijeet Kasurde <akasurde@redhat.com>
(cherry picked from commit c76e074e4c71c7621a1ca8159261c1959b5287af)
| -rw-r--r-- | changelogs/fragments/63522-remove-args-from-sumologic-and-splunk-callbacks.yml | 2 | ||||
| -rw-r--r-- | lib/ansible/plugins/callback/splunk.py | 3 | ||||
| -rw-r--r-- | lib/ansible/plugins/callback/sumologic.py | 3 |
3 files changed, 8 insertions, 0 deletions
diff --git a/changelogs/fragments/63522-remove-args-from-sumologic-and-splunk-callbacks.yml b/changelogs/fragments/63522-remove-args-from-sumologic-and-splunk-callbacks.yml new file mode 100644 index 0000000000..7af27d9082 --- /dev/null +++ b/changelogs/fragments/63522-remove-args-from-sumologic-and-splunk-callbacks.yml @@ -0,0 +1,2 @@ +bugfixes: + - '**security issue** - Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs (CVE-2019-14864)' diff --git a/lib/ansible/plugins/callback/splunk.py b/lib/ansible/plugins/callback/splunk.py index 26b5d1d885..4f0e7eec3c 100644 --- a/lib/ansible/plugins/callback/splunk.py +++ b/lib/ansible/plugins/callback/splunk.py @@ -98,6 +98,9 @@ class SplunkHTTPCollectorSource(object): else: ansible_role = None + if 'args' in result._task_fields: + del result._task_fields['args'] + data = {} data['uuid'] = result._task._uuid data['session'] = self.session diff --git a/lib/ansible/plugins/callback/sumologic.py b/lib/ansible/plugins/callback/sumologic.py index 4a2bd0b5bb..22e217f0b5 100644 --- a/lib/ansible/plugins/callback/sumologic.py +++ b/lib/ansible/plugins/callback/sumologic.py @@ -89,6 +89,9 @@ class SumologicHTTPCollectorSource(object): else: ansible_role = None + if 'args' in result._task_fields: + del result._task_fields['args'] + data = {} data['uuid'] = result._task._uuid data['session'] = self.session |