PT-2018-13775 · Ansible+2 · Ansible Engine+2

Nitzmahone · Published 2018-11-29 · Updated 2026-06-03 · CVE-2018-16859

Positive Technologies (AI Summary)

CVSS v4.0

6.7

Medium

Base vector

AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ansible Engine versions prior to 2.9

Description The issue allows for 'become' passwords to appear in EventLogs in plaintext when executing Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled. A local user with administrator privileges can view these logs and discover the plaintext password.

Recommendations For Ansible Engine versions prior to 2.9, consider disabling PowerShell ScriptBlock logging and Module logging as a temporary workaround to prevent plaintext passwords from being logged. Restrict access to EventLogs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

ALT-PU-2018-2823

ALT-PU-2019-2615

ALT-PU-2020-1490

CVE-2018-16859

GHSA-V735-2PP6-H86R

OPENSUSE-SU-2019:0238-1

OPENSUSE-SU-2019:1125-1

OPENSUSE-SU-2019:1635-1

OPENSUSE-SU-2019:1858-1

OPENSUSE-SU-2019_1635-1

OPENSUSE-SU-2024:10615-1

OPENSUSE-SU-2024:14244-1

OPENSUSE-SU-2024:14536-1

OPENSUSE-SU-2025:15605-1

OPENSUSE-SU-2025:15753-1

OPENSUSE-SU-2026:10944-1

PYSEC-2018-60

RHSA-2018:3770

RHSA-2018:3771

RHSA-2018:3772

RHSA-2018:3773

SUSE-SU-2020:3309-1

Affected Products

Alt Linux

Ansible Engine

Suse

References · 164

• https://github.com/ansible/ansible/pull/49142 · Patch
• https://access.redhat.com/errata/RHSA-2018:3771 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3309-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3770 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:3773 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1635-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15605-1 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16859 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v735-2pp6-h86r · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16859 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2018-16859 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10944-1 · Vendor Advisory