Bug 1640642 (CVE-2018-16837)

Summary: CVE-2018-16837 Ansible: Information leak in "user" module
Product: [Other] Security Response Reporter: Borja Tarraso <btarraso>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: btarraso, carnil, cscribne, dbecker, dominik.mierzejewski, jcammara, jjoyce, jschluet, jtanner, kbasil, lhh, lpeer, mburns, puebele, rhos-maint, sclewis, security-response-team, sisharma, slinaber, sparks, tkuratom, tvignaud, vbellur
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: ansible-engine 2.7.1, ansible-engine 2.6.7, ansible-engine 2.5.11 Doc Type: If docs needed, set a value
Doc Text:
The User module in Ansible leaks any data which is passed on as a parameter to ssh-keygen. This could lead to undesirable situations such as passphrase credentials being passed as a parameter for the ssh-keygen executable, showing those credentials in clear text form for every user which have access just to the process list.
Story Points: ---
Clone Of: Environment:
Last Closed: 2018-11-05 12:22:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1644841, 1644843, 1644844, 1644845, 1747997, 1748866    
Bug Blocks: 1640345    

Description Borja Tarraso 2018-10-18 13:14:22 UTC
"User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.

Comment 1 Borja Tarraso 2018-10-18 13:14:26 UTC
Acknowledgments:

Name: Markus Teufelberger (mgIT Consulting)

Comment 4 Salvatore Bonaccorso 2018-10-24 18:52:02 UTC
Is there any more information on e.g. upstream fix for this issue? Upstream issue reference?

Comment 5 Borja Tarraso 2018-10-25 08:33:12 UTC
In reply to comment 4:
> Is there any more information on e.g. upstream fix for this issue? Upstream
> issue reference?

Here it is: https://github.com/ansible/ansible/pull/47436

Comment 6 Borja Tarraso 2018-10-25 10:16:28 UTC
External References:

https://github.com/ansible/ansible/pull/47436

Comment 7 Chad Scribner 2018-10-30 16:15:31 UTC
Hi Borja,

Are there any blockers to getting https://github.com/ansible/ansible/pull/47487 merged in?  I have a customer interested to know when they can expected the fixes for 2.5, 2.6, and 2.7 to be released via errata.

Comment 9 Borja Tarraso 2018-10-31 17:17:07 UTC
In reply to comment 7:
> Hi Borja,
> 
> Are there any blockers to getting
> https://github.com/ansible/ansible/pull/47487 merged in?  I have a customer
> interested to know when they can expected the fixes for 2.5, 2.6, and 2.7 to
> be released via errata.

We expect to have it by today the fix for all versions, depends of how stable are the tests if I am not wrong. For 2.7 it has been already fixed. Erratas should be soon there.

Comment 10 errata-xmlrpc 2018-11-05 10:54:26 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2.6 for RHEL 7

Via RHSA-2018:3460 https://access.redhat.com/errata/RHSA-2018:3460

Comment 11 errata-xmlrpc 2018-11-05 10:55:01 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2.7 for RHEL 7

Via RHSA-2018:3463 https://access.redhat.com/errata/RHSA-2018:3463

Comment 12 errata-xmlrpc 2018-11-05 10:55:15 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2.5 for RHEL 7

Via RHSA-2018:3461 https://access.redhat.com/errata/RHSA-2018:3461

Comment 13 errata-xmlrpc 2018-11-05 10:55:24 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2 for RHEL 7

Via RHSA-2018:3462 https://access.redhat.com/errata/RHSA-2018:3462

Comment 14 Borja Tarraso 2018-11-05 12:22:12 UTC
Closing the flaw; affects are resolved and trackers also are closed.

Comment 15 Joshua Padman 2019-09-02 12:13:23 UTC
OpenStack 13 and 14 release ansible-2.6.11-1.el7ae which included the fixes for this.
OpenStack 10 offers 2.4 which is vulnerable.

Comment 18 Hardik Vyas 2019-09-04 10:43:16 UTC
Statement:

This issue affects the version of ansible as shipped with Red Hat Ceph Storage 3, as it contains the vulnerable code which leaks the data when ssh-keygen is invoked with any arguments.

Comment 19 Hardik Vyas 2019-09-04 10:43:51 UTC
Gluster uses Ansible package from Ansible repository and hence it will consume fixes from core Ansible.
For Ceph-3 we still maintain Ansible atleast for Ubuntu, Ceph-2 has reached end of life and hence out of support scope.