~ / search / GHSA-hwrm-63v2-42g4

GHSA-hwrm-63v2-42g4

Ansible Leaks Data Passed to ssh-keygen

Source: GitHub Advisory Database (reviewed) High CVE-2018-16837

Packages

EcosystemPackageAffectedFixed in
PyPI ansible >= 2.7.0a1, < 2.7.1 2.7.1
PyPI ansible >= 2.6.0a1, < 2.6.7 2.6.7
PyPI ansible < 2.5.11 2.5.11

Details

As written in the advisory (Markdown source, shown as plain text).

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.

References

External links from the advisory. They lead to third-party sites.