{"action":"Upgrade ansible to 2.5.13 or later.","affected":[{"fixed":"2.5.13","introduced":"0"},{"fixed":"2.6.10","introduced":"2.6.0"},{"fixed":"2.7.4","introduced":"2.7.0"},{"fixed":"2.8.1","introduced":"2.7.5"}],"component":"ansible","cve_ids":["CVE-2018-16859"],"ecosystem":"PyPI","epss":0.00539,"exploited":false,"fixed_versions":["2.7.4","2.8.1","2.5.13","2.6.10"],"ghsa_id":"GHSA-v735-2pp6-h86r","id":"tcs_01M5KG832MD8T5G040AXB9NGHF","modified_at":"2026-06-10T17:00:17.877642758Z","published_at":"2018-11-29T18:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2018-60","https://github.com/ansible/ansible/pull/49142","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16859","http://www.securityfocus.com/bid/106004","https://access.redhat.com/errata/RHSA-2018:3773","https://access.redhat.com/errata/RHSA-2018:3772","https://access.redhat.com/errata/RHSA-2018:3771","https://access.redhat.com/errata/RHSA-2018:3770","http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html","http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html","http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html","https://github.com/advisories/GHSA-v735-2pp6-h86r"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2018-60","url":"https://osv.dev/vulnerability/PYSEC-2018-60"}],"summary":"Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user wi"}