Red Hat Ansible Engine 2.5
Approved changes feed: RSS · Atom
cpe:2.3:a:redhat:ansible_engine:2.5:*:*:*:*:*:*:*
part: a version: 2.5 update: *
| Vendor | Redhat (e942785a-ca89-506e-bd99-50782639cde3) |
|---|---|
| Product | Ansible Engine (16c6ea6d-2eb0-5f5b-8a65-adb48f01e2e7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/ansible |
purl2cpe | 2026-06-01 10:12:54.636983 |
pkg:deb/ubuntu/ansible |
purl2cpe | 2026-06-01 10:12:54.636984 |
pkg:docker/ansible/ansible |
purl2cpe | 2026-06-01 10:12:54.636986 |
pkg:github/ansible/ansible |
purl2cpe | 2026-06-01 10:12:54.636987 |
pkg:rpm/fedora/ansible |
purl2cpe | 2026-06-01 10:12:54.636989 |
pkg:rpm/opensuse/ansible |
purl2cpe | 2026-06-01 10:12:54.636990 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2018-16876 |
vulnerable | 2026-06-08 05:11:05.688084 |
Details available
LOW (3.1)
ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
Published: 2019-01-03T15:00:00.000Z
Updated: 2024-08-05T10:32:54.241Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-16837 |
vulnerable | 2026-06-08 05:11:05.537209 |
Details available
HIGH (7.8)
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.
Published: 2018-10-23T15:00:00.000Z
Updated: 2024-08-05T10:32:54.010Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-10875 |
vulnerable | 2026-06-08 05:10:37.267403 |
Details available
HIGH (7.8)
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
Published: 2018-07-13T22:00:00.000Z
Updated: 2024-08-05T07:46:47.518Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-10874 |
vulnerable | 2026-06-08 05:10:37.265789 |
Details available
HIGH (7.8)
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
Published: 2018-07-02T13:00:00.000Z
Updated: 2024-08-05T07:46:47.224Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.