CVE-2018-16876

Published: Jan 3, 2019Modified: Nov 21, 2024

5.3

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.6 / Impact: 3.6

Source: NVD

Description

ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.

Affected (16)

Products: Redhat: Ansible, Ansible Engine, Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation, Openstack · Debian: Debian Linux · Suse: Package Hub · +1 more

Show all products

Redhat: Ansible, Ansible Engine, Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation, Openstack · Debian: Debian Linux · Suse: Package Hub · Canonical: Ubuntu Linux

6 products

Enterprise Linux Desktop

Enterprise Linux Server

Enterprise Linux Workstation

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Redhat Ansible	From 2.5.0 to 2.5.14
Redhat Ansible	From 2.6.0 to 2.6.11
Redhat Ansible	From 2.7.0 to 2.7.5

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 9.0

Configuration C

8 vulnerable

Vulnerable Software	Affected Versions
Redhat Ansible Engine	Version 2.0
Redhat Ansible Engine	Version 2.5
Redhat Ansible Engine	Version 2.6
Redhat Ansible Engine	Version 2.7
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Workstation	Version 7.0
Redhat Openstack	Version 14

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Suse Package Hub	All versions

Running on/with	Platform Versions
Suse Linux Enterprise	Version 12.0

Configuration E

3 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 18.04
Canonical Ubuntu Linux	Version 19.04

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (28)

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/106225

Source: secalert@redhat.com

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2018:3835

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:3836

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:3837

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:3838

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2019:0564

Source: secalert@redhat.com

Vendor Advisory

https://access.redhat.com/errata/RHSA-2019:0590

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16876

Source: secalert@redhat.com

Issue TrackingPatchVendor Advisory

https://github.com/ansible/ansible/pull/49569

Source: secalert@redhat.com

PatchThird Party Advisory

https://usn.ubuntu.com/4072-1/

Source: secalert@redhat.com

Third Party Advisory

https://www.debian.org/security/2019/dsa-4396

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.securityfocus.com/bid/106225

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2018:3835

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:3836

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:3837

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2018:3838

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2019:0564

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://access.redhat.com/errata/RHSA-2019:0590

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16876

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchVendor Advisory

https://github.com/ansible/ansible/pull/49569

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://usn.ubuntu.com/4072-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2019/dsa-4396

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.