CVE-2018-16859
published 2018-11-29CVE-2018-16859: Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear…
PriorityP419medium4.4CVSS 3.0
AVLACLPRHUINSUCHINAN
EPSS
0.53%
41.9th percentile
Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ansible | — | — |
| red_hat | ansible | — | — |
| redhat | ansible | >= 0 < 2.7.3-r0 | 2.7.3-r0 |
| redhat | ansible | >= 0 < 2.5.12 | 2.5.12 |
| redhat | ansible | >= 2.6.0a1 < 2.6.9 | 2.6.9 |
| redhat | ansible | >= 2.7.0a1 < 2.7.3 | 2.7.3 |
| redhat | ansible_engine | < 2.5.13 | 2.5.13 |
| redhat | ansible_engine | >= 2.6.0 < 2.6.10 | 2.6.10 |
| redhat | ansible_engine | >= 2.7.0 < 2.7.4 | 2.7.4 |
| redhat | ansible_engine | 2.7.5 – 2.8 | — |
CVSS provenance
nvdv3.04.4MEDIUMCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv4.4MEDIUM
vendor_debian4.2LOW
vendor_redhat4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ansible: become password logged in plaintext when used with PowerShell on Windows
vendor_redhat·2018-11-16·CVSS 4.2
CVE-2018-16859 [MEDIUM] CWE-532 ansible: become password logged in plaintext when used with PowerShell on Windows
ansible: become password logged in plaintext when used with PowerShell on Windows
Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.
Execution of Ansible content on Microsoft's Windows platform with Powershell 5 or higher may disclose sensitive execution details including 'become' passwords, Ansible module arguments, and return values via Powershell's 'suspicious scriptblock logging' feature, which is enabled by default. The details are logged to the Powershell Operational log, which
Debian
CVE-2018-16859: ansible - Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock ...
vendor_debian·2018·CVSS 4.2
CVE-2018-16859 [MEDIUM] CVE-2018-16859: ansible - Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock ...
Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
GHSA
Ansible Logs Passwords If PowerShell ScriptBlock is Enabled
ghsa·2022-05-14
CVE-2018-16859 [MEDIUM] CWE-532 Ansible Logs Passwords If PowerShell ScriptBlock is Enabled
Ansible Logs Passwords If PowerShell ScriptBlock is Enabled
Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.
OSV
Ansible Logs Passwords If PowerShell ScriptBlock is Enabled
osv·2022-05-14
CVE-2018-16859 [MEDIUM] Ansible Logs Passwords If PowerShell ScriptBlock is Enabled
Ansible Logs Passwords If PowerShell ScriptBlock is Enabled
Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.
OSV
CVE-2018-16859: Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to
osv·2018-11-29·CVSS 4.4
CVE-2018-16859 [MEDIUM] CVE-2018-16859: Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to
Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.
No detection rules found.
No public exploits indexed.
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.htmlhttp://www.securityfocus.com/bid/106004https://access.redhat.com/errata/RHSA-2018:3770https://access.redhat.com/errata/RHSA-2018:3771https://access.redhat.com/errata/RHSA-2018:3772https://access.redhat.com/errata/RHSA-2018:3773https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16859https://github.com/ansible/ansible/pull/49142http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.htmlhttp://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.htmlhttp://www.securityfocus.com/bid/106004https://access.redhat.com/errata/RHSA-2018:3770https://access.redhat.com/errata/RHSA-2018:3771https://access.redhat.com/errata/RHSA-2018:3772https://access.redhat.com/errata/RHSA-2018:3773https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16859https://github.com/ansible/ansible/pull/49142
2018-11-29
Published