OPENSUSE-SU-2019:1635-1
Vulnerability from csaf_opensuse - Published: 2019-06-27 05:50 - Updated: 2026-09-20 18:51Summary
Security update for ansible
Severity
Moderate
Notes
Title of the patch: Security update for ansible
Description of the patch: This update for ansible fixes the following issues:
Ansible was updated to version 2.8.1:
Full changelog is at /usr/share/doc/packages/ansible/changelogs/
- Bugfixes
- ACI - DO not encode query_string
- ACI modules - Fix non-signature authentication
- Add missing directory provided via ``--playbook-dir`` to adjacent collection loading
- Fix 'Interface not found' errors when using eos_l2_interface with nonexistant
interfaces configured
- Fix cannot get credential when `source_auth` set to `credential_file`.
- Fix netconf_config backup string issue
- Fix privilege escalation support for the docker connection plugin when
credentials need to be supplied (e.g. sudo with password).
- Fix vyos cli prompt inspection
- Fixed loading namespaced documentation fragments from collections.
- Fixing bug came up after running cnos_vrf module against coverity.
- Properly handle data importer failures on PVC creation, instead of timing out.
- To fix the ios static route TC failure in CI
- To fix the nios member module params
- To fix the nios_zone module idempotency failure
- add terminal initial prompt for initial connection
- allow include_role to work with ansible command
- allow python_requirements_facts to report on dependencies containing dashes
- asa_config fix
- azure_rm_roledefinition - fix a small error in build scope.
- azure_rm_virtualnetworkpeering - fix cross subscriptions virtual network
peering.
- cgroup_perf_recap - When not using file_per_task, make sure we don't
prematurely close the perf files
- display underlying error when reporting an invalid ``tasks:`` block.
- dnf - fix wildcard matching for state: absent
- docker connection plugin - accept version ``dev`` as 'newest version' and
print warning.
- docker_container - ``oom_killer`` and ``oom_score_adj`` options are available
since docker-py 1.8.0, not 2.0.0 as assumed by the version check.
- docker_container - fix network creation when ``networks_cli_compatible`` is
enabled.
- docker_container - use docker API's ``restart`` instead of ``stop``/``start``
to restart a container.
- docker_image - if ``build`` was not specified, the wrong default for
``build.rm`` is used.
- docker_image - if ``nocache`` set to ``yes`` but not ``build.nocache``, the
module failed.
- docker_image - module failed when ``source: build`` was set but
``build.path`` options not specified.
- docker_network module - fix idempotency when using ``aux_addresses`` in
``ipam_config``.
- ec2_instance - make Name tag idempotent
- eos: don't fail modules without become set, instead show message and continue
- eos_config: check for session support when asked to 'diff_against: session'
- eos_eapi: fix idempotency issues when vrf was unspecified.
- fix bugs for ce - more info see
- fix incorrect uses of to_native that should be to_text instead.
- hcloud_volume - Fix idempotency when attaching a server to a volume.
- ibm_storage - Added a check for null fields in ibm_storage utils module.
- include_tasks - whitelist ``listen`` as a valid keyword
- k8s - resource updates applied with force work correctly now
- keep results subset also when not no_log.
- meraki_switchport - improve reliability with native VLAN functionality.
- netapp_e_iscsi_target - fix netapp_e_iscsi_target chap secret size and
clearing functionality
- netapp_e_volumes - fix workload profileId indexing when no previous workload
tags exist on the storage array.
- nxos_acl some platforms/versions raise when no ACLs are present
- nxos_facts fix <https://github.com/ansible/ansible/pull/57009>
- nxos_file_copy fix passwordless workflow
- nxos_interface Fix admin_state check for n6k
- nxos_snmp_traps fix group all for N35 platforms
- nxos_snmp_user fix platform fixes for get_snmp_user
- nxos_vlan mode idempotence bug
- nxos_vlan vlan names containing regex ctl chars should be escaped
- nxos_vtp_* modules fix n6k issues
- openssl_certificate - fix private key passphrase handling for
``cryptography`` backend.
- openssl_pkcs12 - fixes crash when private key has a passphrase and the module
is run a second time.
- os_stack - Apply tags conditionally so that the module does not throw up an
error when using an older distro of openstacksdk
- pass correct loading context to persistent connections other than local
- pkg_mgr - Ansible 2.8.0 failing to install yum packages on Amazon Linux
- postgresql - added initial SSL related tests
- postgresql - added missing_required_libs, removed excess param mapping
- postgresql - move connect_to_db and get_pg_version into
module_utils/postgres.py (https://github.com/ansible/ansible/pull/55514)
- postgresql_db - add note to the documentation about state dump and the
incorrect rc (https://github.com/ansible/ansible/pull/57297)
- postgresql_db - fix for postgresql_db fails if stderr contains output
- postgresql_ping - fixed a typo in the module documentation
- preserve actual ssh error when we cannot connect.
- route53_facts - the module did not advertise check mode support, causing it
not to be run in check mode.
- sysctl: the module now also checks the output of STDERR to report if values
are correctly set (https://github.com/ansible/ansible/pull/55695)
- ufw - correctly check status when logging is off
- uri - always return a value for status even during failure
- urls - Handle redirects properly for IPv6 address by not splitting on ``:``
and rely on already parsed hostname and port values
- vmware_vm_facts - fix the support with regular ESXi
- vyos_interface fix <https://github.com/ansible/ansible/pull/57169>
- we don't really need to template vars on definition as we do this on demand
in templating.
- win_acl - Fix qualifier parser when using UNC paths -
- win_hostname - Fix non netbios compliant name handling
- winrm - Fix issue when attempting to parse CLIXML on send input failure
- xenserver_guest - fixed an issue where VM whould be powered off even though
check mode is used if reconfiguration requires VM to be powered off.
- xenserver_guest - proper error message is shown when maximum number of
network interfaces is reached and multiple network interfaces are added at
once.
- yum - Fix false error message about autoremove not being supported
- yum - fix failure when using ``update_cache`` standalone
- yum - handle special '_none_' value for proxy in yum.conf and .repo files
Update to version 2.8.0
Major changes:
* Experimental support for Ansible Collections and content namespacing -
Ansible content can now be packaged in a collection and addressed via
namespaces. This allows for easier sharing, distribution, and installation
of bundled modules/roles/plugins, and consistent rules for accessing
specific content via namespaces.
* Python interpreter discovery - The first time a Python module runs on a
target, Ansible will attempt to discover the proper default Python
interpreter to use for the target platform/version (instead of immediately
defaulting to /usr/bin/python). You can override this behavior by
setting ansible_python_interpreter or via config.
(see https://github.com/ansible/ansible/pull/50163)
* become - The deprecated CLI arguments for --sudo, --sudo-user,
--ask-sudo-pass, -su, --su-user, and --ask-su-pass have been removed, in
favor of the more generic --become, --become-user, --become-method, and
--ask-become-pass.
* become - become functionality has been migrated to a plugin architecture,
to allow customization of become functionality and 3rd party become methods
(https://github.com/ansible/ansible/pull/50991)
- addresses CVE-2018-16859, CVE-2018-16876, CVE-2019-3828, CVE-2018-16837
For the full changelog see /usr/share/doc/packages/ansible/changelogs or online:
https://github.com/ansible/ansible/blob/stable-2.8/changelogs/CHANGELOG-v2.8.rst
Patchnames: openSUSE-2019-1635
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.8 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
4.2 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2018-16837
Threats
Impact
moderate
Affected products
Recommended
4 products, the same list as for
CVE-2018-16837
Threats
Impact
low
4.2 (Medium)
Affected products
Recommended
4 products, the same list as for
CVE-2018-16837
Threats
Impact
moderate
References
23 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for ansible",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for ansible fixes the following issues:\n\nAnsible was updated to version 2.8.1:\n\nFull changelog is at /usr/share/doc/packages/ansible/changelogs/\n\n- Bugfixes\n\n - ACI - DO not encode query_string\n - ACI modules - Fix non-signature authentication\n - Add missing directory provided via ``--playbook-dir`` to adjacent collection loading\n - Fix \u0027Interface not found\u0027 errors when using eos_l2_interface with nonexistant\n interfaces configured\n - Fix cannot get credential when `source_auth` set to `credential_file`.\n - Fix netconf_config backup string issue\n - Fix privilege escalation support for the docker connection plugin when\n credentials need to be supplied (e.g. sudo with password).\n - Fix vyos cli prompt inspection\n - Fixed loading namespaced documentation fragments from collections.\n - Fixing bug came up after running cnos_vrf module against coverity.\n - Properly handle data importer failures on PVC creation, instead of timing out.\n - To fix the ios static route TC failure in CI\n - To fix the nios member module params\n - To fix the nios_zone module idempotency failure\n - add terminal initial prompt for initial connection\n - allow include_role to work with ansible command\n - allow python_requirements_facts to report on dependencies containing dashes\n - asa_config fix\n - azure_rm_roledefinition - fix a small error in build scope.\n - azure_rm_virtualnetworkpeering - fix cross subscriptions virtual network\n peering.\n - cgroup_perf_recap - When not using file_per_task, make sure we don\u0027t\n prematurely close the perf files\n - display underlying error when reporting an invalid ``tasks:`` block.\n - dnf - fix wildcard matching for state: absent\n - docker connection plugin - accept version ``dev`` as \u0027newest version\u0027 and\n print warning.\n - docker_container - ``oom_killer`` and ``oom_score_adj`` options are available\n since docker-py 1.8.0, not 2.0.0 as assumed by the version check.\n - docker_container - fix network creation when ``networks_cli_compatible`` is\n enabled.\n - docker_container - use docker API\u0027s ``restart`` instead of ``stop``/``start``\n to restart a container.\n - docker_image - if ``build`` was not specified, the wrong default for\n ``build.rm`` is used.\n - docker_image - if ``nocache`` set to ``yes`` but not ``build.nocache``, the\n module failed.\n - docker_image - module failed when ``source: build`` was set but\n ``build.path`` options not specified.\n - docker_network module - fix idempotency when using ``aux_addresses`` in\n ``ipam_config``.\n - ec2_instance - make Name tag idempotent\n - eos: don\u0027t fail modules without become set, instead show message and continue\n - eos_config: check for session support when asked to \u0027diff_against: session\u0027\n - eos_eapi: fix idempotency issues when vrf was unspecified.\n - fix bugs for ce - more info see\n - fix incorrect uses of to_native that should be to_text instead.\n - hcloud_volume - Fix idempotency when attaching a server to a volume.\n - ibm_storage - Added a check for null fields in ibm_storage utils module.\n - include_tasks - whitelist ``listen`` as a valid keyword\n - k8s - resource updates applied with force work correctly now\n - keep results subset also when not no_log.\n - meraki_switchport - improve reliability with native VLAN functionality.\n - netapp_e_iscsi_target - fix netapp_e_iscsi_target chap secret size and\n clearing functionality\n - netapp_e_volumes - fix workload profileId indexing when no previous workload\n tags exist on the storage array.\n - nxos_acl some platforms/versions raise when no ACLs are present\n - nxos_facts fix \u003chttps://github.com/ansible/ansible/pull/57009\u003e\n - nxos_file_copy fix passwordless workflow\n - nxos_interface Fix admin_state check for n6k\n - nxos_snmp_traps fix group all for N35 platforms\n - nxos_snmp_user fix platform fixes for get_snmp_user\n - nxos_vlan mode idempotence bug\n - nxos_vlan vlan names containing regex ctl chars should be escaped\n - nxos_vtp_* modules fix n6k issues\n - openssl_certificate - fix private key passphrase handling for\n ``cryptography`` backend.\n - openssl_pkcs12 - fixes crash when private key has a passphrase and the module\n is run a second time.\n - os_stack - Apply tags conditionally so that the module does not throw up an\n error when using an older distro of openstacksdk\n - pass correct loading context to persistent connections other than local\n - pkg_mgr - Ansible 2.8.0 failing to install yum packages on Amazon Linux\n - postgresql - added initial SSL related tests\n - postgresql - added missing_required_libs, removed excess param mapping\n - postgresql - move connect_to_db and get_pg_version into\n module_utils/postgres.py (https://github.com/ansible/ansible/pull/55514)\n - postgresql_db - add note to the documentation about state dump and the\n incorrect rc (https://github.com/ansible/ansible/pull/57297)\n - postgresql_db - fix for postgresql_db fails if stderr contains output\n - postgresql_ping - fixed a typo in the module documentation\n - preserve actual ssh error when we cannot connect.\n - route53_facts - the module did not advertise check mode support, causing it\n not to be run in check mode.\n - sysctl: the module now also checks the output of STDERR to report if values\n are correctly set (https://github.com/ansible/ansible/pull/55695)\n - ufw - correctly check status when logging is off\n - uri - always return a value for status even during failure\n - urls - Handle redirects properly for IPv6 address by not splitting on ``:``\n and rely on already parsed hostname and port values\n - vmware_vm_facts - fix the support with regular ESXi\n - vyos_interface fix \u003chttps://github.com/ansible/ansible/pull/57169\u003e\n - we don\u0027t really need to template vars on definition as we do this on demand\n in templating.\n - win_acl - Fix qualifier parser when using UNC paths -\n - win_hostname - Fix non netbios compliant name handling\n - winrm - Fix issue when attempting to parse CLIXML on send input failure\n - xenserver_guest - fixed an issue where VM whould be powered off even though\n check mode is used if reconfiguration requires VM to be powered off.\n - xenserver_guest - proper error message is shown when maximum number of\n network interfaces is reached and multiple network interfaces are added at\n once.\n - yum - Fix false error message about autoremove not being supported\n - yum - fix failure when using ``update_cache`` standalone\n - yum - handle special \u0027_none_\u0027 value for proxy in yum.conf and .repo files\n\nUpdate to version 2.8.0\n\nMajor changes:\n\n * Experimental support for Ansible Collections and content namespacing -\n Ansible content can now be packaged in a collection and addressed via\n namespaces. This allows for easier sharing, distribution, and installation\n of bundled modules/roles/plugins, and consistent rules for accessing\n specific content via namespaces.\n * Python interpreter discovery - The first time a Python module runs on a\n target, Ansible will attempt to discover the proper default Python\n interpreter to use for the target platform/version (instead of immediately\n defaulting to /usr/bin/python). You can override this behavior by\n setting ansible_python_interpreter or via config. \n (see https://github.com/ansible/ansible/pull/50163)\n * become - The deprecated CLI arguments for --sudo, --sudo-user,\n --ask-sudo-pass, -su, --su-user, and --ask-su-pass have been removed, in\n favor of the more generic --become, --become-user, --become-method, and\n --ask-become-pass.\n * become - become functionality has been migrated to a plugin architecture,\n to allow customization of become functionality and 3rd party become methods\n (https://github.com/ansible/ansible/pull/50991)\n\n- addresses CVE-2018-16859, CVE-2018-16876, CVE-2019-3828, CVE-2018-16837\n\nFor the full changelog see /usr/share/doc/packages/ansible/changelogs or online:\nhttps://github.com/ansible/ansible/blob/stable-2.8/changelogs/CHANGELOG-v2.8.rst\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2019-1635",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2019_1635-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2019:1635-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CNUI5PK7YDZ2U7TUWHBUA2RBMOIH2AMY/#CNUI5PK7YDZ2U7TUWHBUA2RBMOIH2AMY"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2019:1635-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CNUI5PK7YDZ2U7TUWHBUA2RBMOIH2AMY/#CNUI5PK7YDZ2U7TUWHBUA2RBMOIH2AMY"
},
{
"category": "self",
"summary": "SUSE Bug 1109957",
"url": "https://bugzilla.suse.com/1109957"
},
{
"category": "self",
"summary": "SUSE Bug 1112959",
"url": "https://bugzilla.suse.com/1112959"
},
{
"category": "self",
"summary": "SUSE Bug 1118896",
"url": "https://bugzilla.suse.com/1118896"
},
{
"category": "self",
"summary": "SUSE Bug 1126503",
"url": "https://bugzilla.suse.com/1126503"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-16837 page",
"url": "https://www.suse.com/security/cve/CVE-2018-16837/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-16859 page",
"url": "https://www.suse.com/security/cve/CVE-2018-16859/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-16876 page",
"url": "https://www.suse.com/security/cve/CVE-2018-16876/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-3828 page",
"url": "https://www.suse.com/security/cve/CVE-2019-3828/"
}
],
"title": "Security update for ansible",
"tracking": {
"current_release_date": "2026-09-20T18:51:54Z",
"generator": {
"date": "2019-06-27T05:50:47Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2019:1635-1",
"initial_release_date": "2019-06-27T05:50:47Z",
"revision_history": [
{
"date": "2019-06-27T05:50:47Z",
"number": "1",
"summary": "Current version"
},
{
"date": "2026-09-20T18:51:54Z",
"number": "2",
"summary": "unknown changes"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.8.1-bp150.3.9.1.noarch",
"product": {
"name": "ansible-0:2.8.1-bp150.3.9.1.noarch",
"product_id": "ansible-0:2.8.1-bp150.3.9.1.noarch",
"product_identification_helper": {
"cpe": "cpe:2.3:a:redhat:ansible:2.8.1:*:*:*:*:*:*:*",
"purl": "pkg:rpm/suse/ansible@2.8.1-bp150.3.9.1?arch=noarch\u0026upstream=ansible-0:2.8.1-bp150.3.9.1.src.rpm"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Package Hub 12",
"product": {
"name": "SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:12"
}
}
},
{
"category": "product_name",
"name": "SUSE Package Hub 15",
"product": {
"name": "SUSE Package Hub 15",
"product_id": "SUSE Package Hub 15"
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.0",
"product": {
"name": "openSUSE Leap 15.0",
"product_id": "openSUSE Leap 15.0",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.0"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.1",
"product": {
"name": "openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.8.1-bp150.3.9.1.noarch as component of SUSE Package Hub 12",
"product_id": "SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch"
},
"product_reference": "ansible-0:2.8.1-bp150.3.9.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.8.1-bp150.3.9.1.noarch as component of SUSE Package Hub 15",
"product_id": "SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch"
},
"product_reference": "ansible-0:2.8.1-bp150.3.9.1.noarch",
"relates_to_product_reference": "SUSE Package Hub 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.8.1-bp150.3.9.1.noarch as component of openSUSE Leap 15.0",
"product_id": "openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch"
},
"product_reference": "ansible-0:2.8.1-bp150.3.9.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.8.1-bp150.3.9.1.noarch as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
},
"product_reference": "ansible-0:2.8.1-bp150.3.9.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-16837",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-16837"
}
],
"notes": [
{
"category": "general",
"text": "Ansible \"User\" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch",
"SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-16837",
"url": "https://www.suse.com/security/cve/CVE-2018-16837"
},
{
"category": "external",
"summary": "SUSE Bug 1112959 for CVE-2018-16837",
"url": "https://bugzilla.suse.com/1112959"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch",
"SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch",
"SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-06-27T05:50:47Z",
"details": "important"
}
],
"title": "CVE-2018-16837"
},
{
"cve": "CVE-2018-16859",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-16859"
}
],
"notes": [
{
"category": "general",
"text": "Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for \u0027become\u0027 passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch",
"SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-16859",
"url": "https://www.suse.com/security/cve/CVE-2018-16859"
},
{
"category": "external",
"summary": "SUSE Bug 1109957 for CVE-2018-16859",
"url": "https://bugzilla.suse.com/1109957"
},
{
"category": "external",
"summary": "SUSE Bug 1116587 for CVE-2018-16859",
"url": "https://bugzilla.suse.com/1116587"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch",
"SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch",
"SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-06-27T05:50:47Z",
"details": "moderate"
}
],
"title": "CVE-2018-16859"
},
{
"cve": "CVE-2018-16876",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-16876"
}
],
"notes": [
{
"category": "general",
"text": "ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch",
"SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-16876",
"url": "https://www.suse.com/security/cve/CVE-2018-16876"
},
{
"category": "external",
"summary": "SUSE Bug 1109957 for CVE-2018-16876",
"url": "https://bugzilla.suse.com/1109957"
},
{
"category": "external",
"summary": "SUSE Bug 1118896 for CVE-2018-16876",
"url": "https://bugzilla.suse.com/1118896"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch",
"SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch",
"SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-06-27T05:50:47Z",
"details": "low"
}
],
"title": "CVE-2018-16876"
},
{
"cve": "CVE-2019-3828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-3828"
}
],
"notes": [
{
"category": "general",
"text": "Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch",
"SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-3828",
"url": "https://www.suse.com/security/cve/CVE-2019-3828"
},
{
"category": "external",
"summary": "SUSE Bug 1126503 for CVE-2019-3828",
"url": "https://bugzilla.suse.com/1126503"
},
{
"category": "external",
"summary": "SUSE Bug 1164137 for CVE-2019-3828",
"url": "https://bugzilla.suse.com/1164137"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch",
"SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Package Hub 12:ansible-0:2.8.1-bp150.3.9.1.noarch",
"SUSE Package Hub 15:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.0:ansible-0:2.8.1-bp150.3.9.1.noarch",
"openSUSE Leap 15.1:ansible-0:2.8.1-bp150.3.9.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2019-06-27T05:50:47Z",
"details": "moderate"
}
],
"title": "CVE-2019-3828"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…