CVE-2018-16837

Impact:
Moderate
Public Date:
2018-10-23
CWE:
CWE-214
Bugzilla:
1640642: CVE-2018-16837 Ansible: Information leak in "user" module
The User module in Ansible leaks any data which is passed on as a parameter to ssh-keygen. This could lead to undesirable situations such as passphrase credentials being passed as a parameter for the ssh-keygen executable, showing those credentials in clear text form for every user which have access just to the process list.

Find out more about CVE-2018-16837 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v3 metrics

CVSS3 Base Score 7.8
CVSS3 Base Metrics CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity Impact High
Availability Impact High

Red Hat Security Errata

Platform Errata Release Date
Red Hat Ansible Engine 2.7 for RHEL 7 (ansible) RHSA-2018:3463 2018-11-05
Red Hat Ansible Engine 2 for RHEL 7 (ansible) RHSA-2018:3462 2018-11-05
Red Hat Ansible Engine 2.5 for RHEL 7 (ansible) RHSA-2018:3461 2018-11-05
Red Hat Ansible Engine 2.6 for RHEL 7 (ansible) RHSA-2018:3460 2018-11-05

Acknowledgements

Red Hat would like to thank Markus Teufelberger (mgIT Consulting) for reporting this issue.

External References

Last Modified