Read the docs
TI-2018-12086 Aliases CVE-2018-16876GHSA-j569-fghw-f9rx

Information disclosure in Red Hat ansible

Priority LOW 29CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 6 fixed, 11 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.

Why it matters now

EPSS 0.02462 84th percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.5.14, 2.6.11, 2.7.5Red Hat: 6 advisoriesRed Hat: 6 fixed, 11 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red Hatansiblebefore 2.5.14; before 2.6.11; before 2.7.52.5.14, 2.6.11, 2.7.5Patch availableCNA
—ansible (PyPI)before 2.5.142.5.14Patch availableGHSA-j569-fghw-f9rx
—ansible (PyPI)2.6.0a1 to before 2.6.112.6.11Patch availableGHSA-j569-fghw-f9rx
—ansible (PyPI)2.7.0a1 to before 2.7.52.7.5Patch availableGHSA-j569-fghw-f9rx
  • ansible VendorRed Hat Affected before 2.5.14; before 2.6.11; before 2.7.5 Fixed in 2.5.14, 2.6.11, 2.7.5 Patch available CNA
  • ansible (PyPI) Vendor— Affected before 2.5.14 Fixed in 2.5.14 Patch available GHSA-j569-fghw-f9rx
  • ansible (PyPI) Vendor— Affected 2.6.0a1 to before 2.6.11 Fixed in 2.6.11 Patch available GHSA-j569-fghw-f9rx
  • ansible (PyPI) Vendor— Affected 2.7.0a1 to before 2.7.5 Fixed in 2.7.5 Patch available GHSA-j569-fghw-f9rx

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*2.5.0 to before 2.5.14; 2.6.0 to before 2.6.11; 2.7.0 to before 2.7.5VulnerableRed Hat
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:*2.0VulnerableRed Hat
cpe:2.3:a:redhat:ansible_engine:2.5:*:*:*:*:*:*:*2.5VulnerableRed Hat
cpe:2.3:a:redhat:ansible_engine:2.6:*:*:*:*:*:*:*2.6VulnerableRed Hat
cpe:2.3:a:redhat:ansible_engine:2.7:*:*:*:*:*:*:*2.7VulnerableRed Hat
cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*14VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* Versions 2.5.0 to before 2.5.14; 2.6.0 to before 2.6.11; 2.7.0 to before 2.7.5 Vulnerable ·Red Hat
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:a:redhat:ansible_engine:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_engine:2.5:*:*:*:*:*:*:* Versions 2.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_engine:2.6:*:*:*:*:*:*:* Versions 2.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_engine:2.7:*:*:*:*:*:*:* Versions 2.7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* Versions 14 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:*not specified by NVDVulnerableSUSE
cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*12.0Running onSUSE
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*16.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*18.04VulnerableCanonical
cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*19.04VulnerableCanonical
  • cpe:2.3:a:suse:package_hub:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·SUSE
  • cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:* Versions 12.0 Running on ·SUSE
  • cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:* Versions 16.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
  • cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical

Remediation

  • Fix · GHSA-j569-fghw-f9rx ansible (PyPI) Fixed in 2.5.14 Advisory →
  • Fix · GHSA-j569-fghw-f9rx ansible (PyPI) Fixed in 2.6.11 Advisory →
  • Fix · GHSA-j569-fghw-f9rx ansible (PyPI) Fixed in 2.7.5 Advisory →

Red Hat 6 advisories

  • RHSA-2019:0590 Released 2019-03-18 · Red Hat rating Low
    ansible security and bug fix update
    • Red Hat OpenStack Platform 14.0 ansible-2.6.11-1.el7ae
  • RHSA-2019:0564 Released 2019-03-14 · Red Hat rating Low
    Red Hat Enterprise Linux OpenStack Platform security update
    • Red Hat OpenStack Platform 13.0 ansible-2.6.11-1.el7ae, openstack-ec2-api-6.0.1-0.20181123223255.1e25260.el7ost, openstack-manila-1:6.0.2-5.el7ost +26
  • RHSA-2018:3837 Released 2018-12-18 · Red Hat rating Low
    ansible security and bug fix update
    • Red Hat Ansible Engine 2.7 for RHEL 7 Server ansible-2.7.5-1.el7ae
Show 3 more Red Hat advisories
  • RHSA-2018:3838 Released 2018-12-18 · Red Hat rating Low
    ansible security and bug fix update
    • Red Hat Ansible Engine 2 for RHEL 7 ansible-2.7.5-1.el7ae
  • RHSA-2018:3835 Released 2018-12-18 · Red Hat rating Low
    ansible security and bug fix update
    • Red Hat Ansible Engine 2.5 for RHEL 7 Server ansible-2.5.14-1.el7ae, ansible-doc-2.5.14-1.el7ae
  • RHSA-2018:3836 Released 2018-12-18 · Red Hat rating Low
    ansible security and bug fix update
    • Red Hat Ansible Engine 2.6 for RHEL 7 Server ansible-2.6.11-1.el7ae

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 2AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.2AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.3AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.4AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.5AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.6AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 3.7AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Will not fix
Red Hat Satellite 6AffectedNo fix planned: Out of support scope
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Ansible Engine 2 for RHEL 7Fixed RHSA-2018:3838
Red Hat Ansible Engine 2.5 for RHEL 7 ServerFixed RHSA-2018:3835
Red Hat Ansible Engine 2.6 for RHEL 7 ServerFixed RHSA-2018:3836
Red Hat Ansible Engine 2.7 for RHEL 7 ServerFixed RHSA-2018:3837
Red Hat OpenStack Platform 13.0Fixed RHSA-2019:0564
Red Hat OpenStack Platform 14.0Fixed RHSA-2019:0590
Not affected: 2 products
  • CloudForms Management Engine 5
  • Red Hat Ansible Tower 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-16876
  2. 2026-10-03 Alias added: GHSA-j569-fghw-f9rx

References

Patch 2

Advisory 12

Other 8

  • TI-2016-07808 Improper input validation in Ansible CVSS 3.1HIGH 8.1
  • TI-2014-03853 Injection in Ansible CVSS 3.1CRITICAL 9.8
  • TI-2014-03839 The safe_eval function in Ansible before 1.5.4 does not properly restrict the code… CVSS 3.1CRITICAL 9.8
  • TI-2017-05191 Sensitive information in log files in Red Hat ansible CVSS 3.1CRITICAL 9.8
  • TI-2014-04077 Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote… CVSS 3.1CRITICAL 9.8
  • TI-2014-04076 Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings… CVSS 3.1CRITICAL 9.8
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences