CVSS 3.0
7.8 highCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2018-16837
High (7.8). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in ansible 2.5.11, 2.6.7, 2.7.1.
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-311, CWE-214
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- redhat:ansible_engine
- redhat:ansible_tower
- suse:package_hub
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-hwrm-63v2-42g4 | PyPI | ansible | >=2.7.0a1 <2.7.1 | 2.7.1 |
| GHSA-hwrm-63v2-42g4 | PyPI | ansible | >=2.6.0a1 <2.6.7 | 2.6.7 |
| GHSA-hwrm-63v2-42g4 | PyPI | ansible | <2.5.11 | 2.5.11 |
| PYSEC-2018-44 | PyPI | ansible | >=2.7 <2.7.1 >=2.6 <2.6.7 <2.5.11 | 2.7.1, 2.6.7, 2.5.11 |
References
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html
- http://www.securityfocus.com/bid/105700
- https://access.redhat.com/errata/RHSA-2018:3460