CVE-2018-16859

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.

Metrics

CVSS 3.0 4.4/10CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

Vendor	Product	Versions
Red Hat	ansible	2.8 and older

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html
http://www.securityfocus.com/bid/106004Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:3770Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3771Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3772Issue Tracking, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3773Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16859Issue Tracking, Vendor Advisory
https://github.com/ansible/ansible/pull/49142Patch, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html
http://www.securityfocus.com/bid/106004Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:3770Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3771Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3772Issue Tracking, Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:3773Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16859Issue Tracking, Vendor Advisory
https://github.com/ansible/ansible/pull/49142Patch, Third Party Advisory

Timeline

Published: Nov 29, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-16865.4IBM Maximo Asset Management 7.6 through 7.6.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary Java CVE-2018-168607.5A flaw was found in samba's Heimdal KDC implementation, versions 4.8.x up to, excluding 4.8.12, 4.9.x up to, excluding 4.9.8 and 4.10.x up t CVE-2018-168614.8A cross-site scripting (XSS) flaw was found in the foreman component of satellite. An attacker with privilege to create entries using the Ho CVE-2018-168625.5A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation (remova CVE-2018-168637.8It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509. An attacker could possibly exploit another variant of the flaw and bypass CVE-2018-168647.8An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journa CVE-2018-168657.8An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journa CVE-2018-168663.3An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker CVE-2018-168677.8A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/us CVE-2018-168685.6A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 CVE-2018-168695.7A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 CVE-2018-168705.9It was found that wolfssl before 3.15.7 is vulnerable to a new variant of the Bleichenbacher attack to perform downgrade attacks against TLS