VDB
PYSEC-2018-60
PYSEC-2018-60
PUBLISHED
Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | ansible | 1.2.2, 2.7.5, 0 |
Timeline
- Nov 29, 2018 CVE Published
- Apr 22, 2024 CVE Updated
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Distribution Patch
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16859 report
- http://www.securityfocus.com/bid/106004 url
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html url
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html url
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html url
- https://github.com/ansible/ansible/pull/49142 fix
- https://access.redhat.com/errata/RHSA-2018:3773 advisory
- https://access.redhat.com/errata/RHSA-2018:3772 advisory
- https://access.redhat.com/errata/RHSA-2018:3771 advisory
- https://access.redhat.com/errata/RHSA-2018:3770 advisory