GitHub Advisoryadvisory · PyPI

GHSA-hwrm-63v2-42g4 Ansible Leaks Data Passed to ssh-keygen

HIGH Published 2022-05-13 Modified 2024-09-04 Official page ↗
Aliases
CVE-2018-16837
Ecosystem
PyPI
Packages
ansible
Severity
High
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-311
Reviewed
2024-04-22

Affected packages

• PyPI ansible: >= 2.7.0a1, < 2.7.1 → fixed in 2.7.1 • PyPI ansible: >= 2.6.0a1, < 2.6.7 → fixed in 2.6.7 • PyPI ansible: < 2.5.11 → fixed in 2.5.11

Description

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.

Related

Alias · CVE (1)

  • CVE-2018-16837 Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. vulnerability

Weakness · CWE (1)

  • CWE-311 Missing Encryption of Sensitive Data weakness

References