CVE-2018-16876 Ansible sensitive information disclosure
Attackers can leak sensitive data when using verbose mode with logging disabled in Ansible, requiring an upgrade to secure configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-16876?
CVE-2018-16876 is a low-severity vulnerability in Canonical Ubuntu Linux, published on 3 Jan 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
Weakness: CWE-200
Which versions are affected by CVE-2018-16876?
7 open source packages ship an affected version, including ansible. It affects 9 products.
| Package | Affected | Fixed in |
|---|---|---|
ansible PyPI | All versions | 2.5.14 |
ansible PyPI | All versions | 2.5.14 |
ansible PyPI | From 2.5.0 | 2.5.14, 2.6.11, 2.7.5 |
ansible PyPI | From 2.6.0a1 | 2.6.11 |
ansible PyPI | From 2.6.0a1 | 2.6.11 |
ansible PyPI | From 2.7.0a1 | 2.7.5 |
1 more packages
ansible PyPI | From 2.7.0a1 | 2.7.5 |
Linux distribution packages (5)
ansible Red Hat:ansible_engine:2.5::el7 | All versions | 0:2.5.14-1.el7ae |
ansible-doc Red Hat:ansible_engine:2.5::el7 | All versions | 0:2.5.14-1.el7ae |
ansible Red Hat:ansible_engine:2.6::el7 | All versions | 0:2.6.11-1.el7ae |
ansible Red Hat:ansible_engine:2.7::el7 | All versions | 0:2.7.5-1.el7ae |
ansible Red Hat:ansible_engine:2::el7 | All versions | 0:2.7.5-1.el7ae |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Redhat Ansible, Redhat Ansible Engine, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server and 3 more.
How do I fix CVE-2018-16876?
Upgrade ansible to a fixed version for your release line: 2.5.14, 2.6.11 or 2.7.5.
Is CVE-2018-16876 being exploited?
There is no known exploitation of CVE-2018-16876 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as ALPINE-CVE-2018-16876, DEBIAN-CVE-2018-16876, GHSA-j569-fghw-f9rx, MGASA-2019-0023, PYSEC-2019-141, RHSA-2018:3835 and 4 more.