GitHub Advisoryadvisory · PyPI

GHSA-v735-2pp6-h86r Ansible Logs Passwords If PowerShell ScriptBlock is Enabled

MEDIUM Published 2022-05-14 Modified 2024-09-04 Official page ↗
Aliases
CVE-2018-16859
Ecosystem
PyPI
Packages
ansible
Severity
Moderate
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2024-04-22

Affected packages

• PyPI ansible: >= 2.7.0a1, < 2.7.3 → fixed in 2.7.3 • PyPI ansible: < 2.5.12 → fixed in 2.5.12 • PyPI ansible: >= 2.6.0a1, < 2.6.9 → fixed in 2.6.9

Description

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.

Related

Alias · CVE (1)

  • CVE-2018-16859 Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become'… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References