Information disclosure in Ansible - CVE-2018-16876

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU16629

Information disclosure in Ansible - CVE-2018-16876

Published: December 19, 2018 / Updated: December 20, 2018


Vulnerability identifier: #VU16629
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-16876
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to the affected software does not honor the no_log flag for failed tasks with vvv+ mode enabled. A remote attacker can send a specially crafted request to a targeted system via a connection plug-in that is designed to trigger connection exceptions, which could cause task information to be logged and access sensitive information, which could be used to conduct further attacks.


Affected software

Ansible
ansible (Alpine package)
ansible
Red Hat Enterprise Linux Server
Fedora
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
SUSE Linux
Opensuse
SUSE Package Hub for SUSE Linux Enterprise
Red Hat OpenStack
Red Hat OpenStack for IBM Power
Red Hat OpenStack Director Deployment Tools

How to mitigate CVE-2018-16876

The vulnerability has been fixed in the versions 2.5.14, 2.6.11, and 2.7.5.

Ansible - addressed in versions 2.5.14, 2.6.11, 2.7.5
ansible (Alpine package) - update to 2.5.15-r0
ansible - addressed in versions 2.7.5-1.el7, 2.7.5-1.fc28, 2.7.5-1.fc29

External References

Related Security Bulletins