Vulnerability CVE-2018-16837
Published: 2018-10-23

Description:
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.

Type:

CWE-311

 (Missing Encryption of Sensitive Data)

CVSS2 => (AV:L/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
2.1/10
2.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
SUSE -> Package hub 
Redhat -> Ansible engine 
Redhat -> Ansible tower 
Debian -> Debian linux 

 References:
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html
http://www.securityfocus.com/bid/105700
https://access.redhat.com/errata/RHSA-2018:3460
https://access.redhat.com/errata/RHSA-2018:3461
https://access.redhat.com/errata/RHSA-2018:3462
https://access.redhat.com/errata/RHSA-2018:3463
https://access.redhat.com/errata/RHSA-2018:3505
https://access.redhat.com/security/cve/cve-2018-16837
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16837
https://lists.debian.org/debian-lts-announce/2018/11/msg00012.html
https://usn.ubuntu.com/4072-1/
https://www.debian.org/security/2019/dsa-4396
Copyright 2024, cxsecurity.com

 

Back to Top