CVE-2018-16837
High
Description
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.
SeverityHigh
CVSS7.8
Exploit probability—
Product
Redhat Ansible Engine
PublishedOct 23, 2018
First seenOct 23, 2018
Weakness typeCWE-214CWE-214
How to fix
Update
- ansible2.7.1, 2.6.7, 2.5.11 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat ansible_engine | 2.0, 2.5, 2.6, 2.7 | — |
| redhat ansible_tower | 3.3.0 | — |
| debian debian_linux | 8.0, 9.0 | — |
| suse package_hub | No range specified | — |
| ansiblePyPI | 2.7.0a1 ≤ v < 2.7.1, 2.6.0a1 ≤ v < 2.6.7, v < 2.5.11, 2.7 ≤ v < 2.7.1, 2.6 ≤ v < 2.6.7 | 2.7.1, 2.6.7, 2.5.11 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.