VULNERABILITY INTELLIGENCE

CVE-2018-16837

CVSS score7.8 HIGH
EPSS probability0.36%
CISA KEVNot currently listed
Published2018-10-23
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.

Weakness classification

  • CWE-214: Invocation of Process Using Visible Sensitive Information
  • CWE-311: Missing Encryption of Sensitive Data

Primary references