VIR Vulnerability Intelligence Relay

CVE-2018-16876

unknown
Published 2022-05-13 · Modified 2024-04-22
CVSS v3
—
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2
—
VIR risk
—

Description

ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.

Predictions

Exploit likelihood
30%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2018-16876.html

vendor Authored 2026-05-27

Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2018-16876

OS impact
OSVersionStatusFixed in
debian debianbookwormfixed2.7.6+dfsg-1
debian debianbullseyefixed2.7.6+dfsg-1
debian debianforkyfixed2.7.6+dfsg-1
debian debiansidfixed2.7.6+dfsg-1
debian debiantrixiefixed2.7.6+dfsg-1
suse slesaffected

Package impact
EcosystemPackageVulnerableFixed
python PyPIansible<2.5.142.5.14
python PyPIansible>=2.6.0a1,<2.6.112.6.11
python PyPIansible>=2.7.0a1,<2.7.52.7.5
python PyPIansible>=2.7.0,<2.7.52.5.14

References

Verify integrity in audit chain (admin only). AS-IS.