{"id":"CVE-2018-16859","published":"2018-11-29T17:00:00Z","modified":"2024-08-05T10:32:54Z","title":"Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can…","vendor":"Red Hat","product":"ansible","tier":"tail","description":{"text":"Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.2,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00539,"percentile":0.45316,"provenance":"source"},"cwes":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File"}],"references":[{"url":"https://github.com/ansible/ansible/pull/49142","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3770","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16859","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3771","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/106004","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3773","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3772","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html","tags":["vendor-advisory","x_refsource_SUSE"]}],"priority":{"score":12.0,"factors":[{"name":"EPSS percentile","points":9.06},{"name":"CVSS severity","points":2.94}]},"vendorSlug":"red-hat","affectedVersions":[{"vendor":"Red Hat","product":"ansible","versions":["2.8 and older"]}],"affected":[{"ecosystem":"PyPI","package":"ansible","vulnerableRanges":[">=2.7.0a1, <2.7.3","<2.5.12",">=2.6.0a1, <2.6.9",">=2.7.0, <2.7.4",">=2.7.5, <2.8.1","<2.5.13",">=2.6.0, <2.6.10"],"patched":["2.7.3","2.5.12","2.6.9","2.7.4","2.8.1","2.5.13","2.6.10"],"from":["GHSA-v735-2pp6-h86r","PYSEC-2018-60"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0019","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-ansible-cve-2016-8628","children":[{"from":"CVE-2018-16859","to":"CVE-2020-1733","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/ansible/plugins/shell/powershell.py"],"commits":["https://github.com/ansible/ansible/commit/0d746b4198abf84290a093b83cf02b4203d73d9f","https://github.com/ansible/ansible/commit/2f8d3fcf41107efafc14d51ab6e14531ca8f8c87","https://github.com/ansible/ansible/commit/80b9a0a25c5f75e84aefc8f2b293fb1933b154f2","https://github.com/ansible/ansible/commit/8251d9f4c2bc82632ab992277fcd30ccbf87aa47"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2018-16837","published":"2018-10-23","fixed":"2.7.1","kev":false,"link":{"from":"CVE-2018-16837","to":"CVE-2018-16859","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.7.1","toFixed":"2.7.3","daysApart":37}]}},{"cve":"CVE-2018-16876","published":"2019-01-03","fixed":"2.7.5","kev":false,"link":{"from":"CVE-2018-16859","to":"CVE-2018-16876","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.5.13","toFixed":"2.5.14","daysApart":35}]}},{"cve":"CVE-2019-3828","published":"2019-03-27","fixed":"2.7.8","kev":false},{"cve":"CVE-2018-16859","published":"2018-11-29","fixed":"2.8.1","kev":false},{"cve":"CVE-2019-10156","published":"2019-07-30","fixed":"2.8.2","kev":false,"link":{"from":"CVE-2018-16859","to":"CVE-2019-10156","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.8.1","toFixed":"2.8.2","daysApart":243}]}},{"cve":"CVE-2019-10206","published":"2019-11-22","fixed":"2.8.4","kev":false},{"cve":"CVE-2019-10217","published":"2019-11-25","fixed":"2.8.4","kev":false}],"package":"PyPI:ansible"}}