CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2018-16837

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.0

EPSS Ranking 11.9%

CVSS Severity

CVSS v3 Score 7.8

CVSS v2 Score 2.1

References

Products affected by CVE-2018-16837

Redhat » Ansible Engine » Version: 2.0

cpe:2.3:a:redhat:ansible_engine:2.0
Redhat » Ansible Engine » Version: 2.5

cpe:2.3:a:redhat:ansible_engine:2.5
Redhat » Ansible Engine » Version: 2.6

cpe:2.3:a:redhat:ansible_engine:2.6
Redhat » Ansible Engine » Version: 2.7

cpe:2.3:a:redhat:ansible_engine:2.7
Redhat » Ansible Tower » Version: 3.3.0

cpe:2.3:a:redhat:ansible_tower:3.3.0
Suse » Package Hub » Version: N/A

cpe:2.3:a:suse:package_hub:-
Debian » Debian Linux » Version: 8.0

cpe:2.3:o:debian:debian_linux:8.0
Debian » Debian Linux » Version: 9.0

cpe:2.3:o:debian:debian_linux:9.0
Suse » Linux Enterprise » Version: 12.0

cpe:2.3:o:suse:linux_enterprise:12.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2018-16837

Products

Pricing

Contact Us