tocsin

CVE-2018-16837

2 advisories.

PyPI/ansible CVE-2018-16837: high 7.8

Ansible Leaks Data Passed to ssh-keygen

Action: Upgrade ansible to 2.5.11 or later.

pip install ansible==2.7.1
pip install ansible==2.6.7
pip install ansible==2.5.11

Affected

introducedfixedlast affected
2.7.0a12.7.1-
2.6.0a12.6.7-
02.5.11-

Fixed versions

2.7.12.6.72.5.11

Sources

CVE-2018-16837 · published · modified · JSON

PyPI/ansible CVE-2018-16837: unknown

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen

Action: Upgrade ansible to 2.5.11 or later.

pip install ansible==2.7.1
pip install ansible==2.6.7
pip install ansible==2.5.11

Affected

introducedfixedlast affected
02.5.11-
2.62.6.7-
2.72.7.1-

Fixed versions

2.7.12.6.72.5.11

Sources

CVE-2018-16837 · published · modified · JSON