CVE-2018-16837

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16837	Issue Tracking Vendor Advisory
http://www.securityfocus.com/bid/105700	Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:3463	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3462	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3461	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3460	Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3505	Vendor Advisory
https://lists.debian.org/debian-lts-announce/2018/11/msg00012.html	Mailing List Third Party Advisory
https://access.redhat.com/security/cve/cve-2018-16837	Vendor Advisory
https://www.debian.org/security/2019/dsa-4396	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html	Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html
https://usn.ubuntu.com/4072-1/
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html

Configuration 1

cpe:2.3:a:redhat:ansible_engine:2.5:*:*:*:*:*:*:* cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:ansible_engine:2.6:*:*:*:*:*:*:* cpe:2.3:a:redhat:ansible_tower:3.3.0:*:*:*:*:*:*:* cpe:2.3:a:redhat:ansible_engine:2.7:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

---

Published : 2018-10-23 03:29

Updated : 2019-10-03 12:03

---

NVD link : CVE-2018-16837

Mitre link : CVE-2018-16837

No products.

CWE-311

Missing Encryption of Sensitive Data