{"action":"Upgrade ansible to 2.5.11 or later.","affected":[{"fixed":"2.5.11","introduced":"0"},{"fixed":"2.6.7","introduced":"2.6"},{"fixed":"2.7.1","introduced":"2.7"}],"component":"ansible","cve_ids":["CVE-2018-16837"],"ecosystem":"PyPI","epss":0.00365,"exploited":false,"fixed_versions":["2.7.1","2.6.7","2.5.11"],"ghsa_id":"GHSA-hwrm-63v2-42g4","id":"tcs_01M5KG801ETV8K7T84WPPZ2KDG","modified_at":"2026-06-10T17:00:17.612056604Z","published_at":"2018-10-23T15:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2018-44","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16837","http://www.securityfocus.com/bid/105700","https://access.redhat.com/errata/RHSA-2018:3463","https://access.redhat.com/errata/RHSA-2018:3462","https://access.redhat.com/errata/RHSA-2018:3461","https://access.redhat.com/errata/RHSA-2018:3460","https://access.redhat.com/errata/RHSA-2018:3505","https://lists.debian.org/debian-lts-announce/2018/11/msg00012.html","https://access.redhat.com/security/cve/cve-2018-16837","https://www.debian.org/security/2019/dsa-4396","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html","https://usn.ubuntu.com/4072-1/","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html","https://github.com/advisories/GHSA-hwrm-63v2-42g4"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2018-44","url":"https://osv.dev/vulnerability/PYSEC-2018-44"}],"summary":"Ansible \"User\" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen"}