4.2
Moyenne
CVE-2018-16859 Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can…
Description
Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Ansible | Versions non publiées |
Références
- github.com github.com
- RHSA-2018:3770 access.redhat.com
- bugzilla.redhat.com bugzilla.redhat.com
- RHSA-2018:3771 access.redhat.com
- 106004 www.securityfocus.com
- RHSA-2018:3773 access.redhat.com
- RHSA-2018:3772 access.redhat.com
- openSUSE-SU-2019:1125 lists.opensuse.org
- openSUSE-SU-2019:1635 lists.opensuse.org
- openSUSE-SU-2019:1858 lists.opensuse.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de Ansible
Les 29 CVE de Ansible →
CVE-2020-14332
A flaw was found in the Ansible Engine when using module_args
5.5
Moyenne
CVE-2020-14330
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data…
5.0
Moyenne
CVE-2020-10744
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running…
5.0
Moyenne
CVE-2020-1746
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and…
5.0
Moyenne