CVE-2018-16859

描述

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.

如何修補 CVE-2018-16859

要修補 CVE-2018-16859,請將受影響套件升級到下列已修補版本。

• —升級至 2.7.3-r0 或更新版本
• —升級至 2.7.3 或更新版本
• —升級至 2.7.4 或更新版本

CVE-2018-16859 正在被利用嗎?

低 — EPSS 為 0.5%,目前沒有觀察到大規模利用活動。

受影響套件(3)

• from 0, < 2.7.3-r0
• >= 2.7.0a1, < 2.7.3
• >= 2.7.0, < 2.7.4, >= 2.7.5, < 2.8.1, from 0, < 2.5.13, >= 2.6.0, < 2.6.10

CVSS 分數

參考連結(20)

• ADVISORYgithub.com/advisories/GHSA-v735-2pp6-h86r
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2018-16859
• ADVISORYsecurity.alpinelinux.org/vuln/CVE-2018-16859
• PATCHgithub.com/ansible/ansible
• WEB