4.4

CVE-2018-16859

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Ansible Engine Version < 2.5.13
Redhat ≫ Ansible Engine Version >= 2.6.0 < 2.6.10
Redhat ≫ Ansible Engine Version >= 2.7.0 < 2.7.4
Redhat ≫ Ansible Engine Version >= 2.7.5 <= 2.8
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.54% 0.408
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 4.4 0.8 3.6
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
secalert@redhat.com 4.2 0.6 3.6
CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html
http://www.securityfocus.com/bid/106004
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:3770
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3771
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3772
Vendor Advisory
Issue Tracking
https://access.redhat.com/errata/RHSA-2018:3773
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16859
Vendor Advisory
Issue Tracking
https://github.com/ansible/ansible/pull/49142
Patch
Third Party Advisory