CVE-2018-16859: Medium severity red hat ansible engine vulnerability
Published Nov 14, 2018
·Updated
Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password.
Affected Software
10 affected componentsFixes available
redhat/ansible-engine<2.5.13
2.5.13
redhat/ansible-engine<2.6.10
2.6.10
redhat/ansible-engine<2.7.4
2.7.4
pip/ansible>=2.6.0a1<2.6.9
2.6.9
pip/ansible>=0<2.5.12
2.5.12
pip/ansible>=2.7.0a1<2.7.3
2.7.3
RedHat Ansible Engine<2.5.13
RedHat Ansible Engine>=2.6.0<2.6.10
RedHat Ansible Engine>=2.7.0<2.7.4
RedHat Ansible Engine>=2.7.5<=2.8
Remediation
Patch Available
Event History
Nov 29, 2018
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
DescriptionSeverityWeakness
May 14, 2022
Advisory Published
via GitHub·01:14 AM
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID is CVE-2018-16859.
2
What is the severity of CVE-2018-16859?
The severity of CVE-2018-16859 is medium, with a severity value of 4.4.
3
Which Ansible versions are affected by CVE-2018-16859?
Ansible versions 2.5.13 up to exclusive, 2.6.10 up to exclusive, and 2.7.4 up to exclusive are affected.
4
How can a local user with administrator privileges exploit CVE-2018-16859?
A local user with administrator privileges can view EventLogs to discover plaintext passwords.
5
Is there a fix available for CVE-2018-16859?
Yes, the fix for CVE-2018-16859 is available in Ansible versions 2.5.13, 2.6.10, and 2.7.4.