7.8
High
CVE-2018-16837 Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen
Description
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ansible | Versions not published |
Other CVEs of ansible
The 7 CVEs of ansible →
CVE-2019-14856
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
6.4
Medium
CVE-2017-7481
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe
5.3
Medium
CVE-2018-10875
A flaw was found in ansible
7.8
High
CVE-2018-10855
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks
5.9
Medium