CVE-2018-16837
23.10.2018, 15:29
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.Enginsight
| Vendor | Product | Version |
|---|---|---|
| redhat | ansible_engine | 2.0 |
| redhat | ansible_engine | 2.5 |
| redhat | ansible_engine | 2.6 |
| redhat | ansible_engine | 2.7 |
| redhat | ansible_tower | 3.3.0 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
| suse | package_hub | - |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ansible |
|
Common Weakness Enumeration
- CWE-214 - Invocation of Process Using Visible Sensitive InformationA process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
- CWE-311 - Missing Encryption of Sensitive DataThe software does not encrypt sensitive or critical information before storage or transmission.
References