Information Disclosure

2019-01-1509:26:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

28.1%

JSON

ansible is vulnerable to information disclosure. The vulnerability exists in the user module when it passes the ssh_key_passphrase value to the ssh-keygen executable as a parameter, allowing any user with access to the process list to retrieve the passphrase in cleartext.

CPENameOperatorVersion
ansibleeq2.3.1.0__3.el7
ansibleeq2.5.5__1.el7ae
ansibleeq2.4.2.0__0.el7
ansibleeq2.4.1.0__1.el7
ansibleeq2.2.0__0.50.prerelease.el7
ansibleeq2.6.3__1.el7
ansibleeq2.6.10__1.el7ae
ansibleeq2.5.8__1.el7ae
ansibleeq2.4.1.0__1.el7ae
ansibleeq2.4.6.0__1.el7ae

Name	Operator	Version
ansible	eq	2.3.1.0__3.el7
ansible	eq	2.5.5__1.el7ae
ansible	eq	2.4.2.0__0.el7
ansible	eq	2.4.1.0__1.el7
ansible	eq	2.2.0__0.50.prerelease.el7
ansible	eq	2.6.3__1.el7
ansible	eq	2.6.10__1.el7ae
ansible	eq	2.5.8__1.el7ae
ansible	eq	2.4.1.0__1.el7ae
ansible	eq	2.4.6.0__1.el7ae