CVE-2018-16837 Ansible Leaks Data Passed to ssh-keygen
Ansible User module leaks sensitive data like passphrases to the process list, allowing local users to read credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2018-16837?
CVE-2018-16837 is a high-severity vulnerability in Debian Debian Linux, published on 23 Oct 2018. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.
Which versions are affected by CVE-2018-16837?
7 open source packages ship an affected version, including ansible. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
ansible PyPI | All versions | 2.5.11 |
ansible PyPI | All versions | 2.5.11 |
ansible PyPI | From 2.6.0a1 | 2.6.7 |
ansible PyPI | From 2.6.0a1 | 2.6.7 |
ansible PyPI | From 2.7 | 2.7.1, 2.6.7, 2.5.11 |
ansible PyPI | From 2.7.0a1 | 2.7.1 |
1 more packages
ansible PyPI | From 2.7.0a1 | 2.7.1 |
Linux distribution packages (5)
ansible Red Hat:ansible_engine:2.5::el7 | All versions | 0:2.5.11-1.el7ae |
ansible-doc Red Hat:ansible_engine:2.5::el7 | All versions | 0:2.5.11-1.el7ae |
ansible Red Hat:ansible_engine:2.6::el7 | All versions | 0:2.6.7-1.el7ae |
ansible Red Hat:ansible_engine:2.7::el7 | All versions | 0:2.7.1-1.el7ae |
ansible Red Hat:ansible_engine:2::el7 | All versions | 0:2.7.1-1.el7ae |
Products include Debian Debian Linux, Redhat Ansible Engine, Redhat Ansible Tower, Suse Package Hub.
How do I fix CVE-2018-16837?
Upgrade ansible to a fixed version for your release line: 2.5.11, 2.6.7 or 2.7.1.
Is CVE-2018-16837 being exploited?
There is no known exploitation of CVE-2018-16837 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2018-16837, CLSA-2025-1747902752, DEBIAN-CVE-2018-16837, DLA-1576-1, GHSA-hwrm-63v2-42g4, PYSEC-2018-44 and 5 more.