CVE-2018-16837CWE-214

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen

High · published October 23, 2018

CVSS v3.0
7.8
EPSS
0%
Percentile
29.2
In the wild
Unconfirmed
What it is

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00365 · 29.2th percentile
Weakness
CWE-214 · Invocation of Process Using Visible Sensitive Information
Published
2018-10-23T15:00Z
EPSS history
Timeline
  • 23 OCT 15:00Z
    Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen
    cvelistv5