CVE-2018-16876: canonical ubuntu_linux
Vulnerability summary
CVE-2018-16876 is a medium (CVSS 5.3) vulnerability in canonical ubuntu_linux. EPSS estimates a 2.48% chance of exploitation in the next 30 days, higher than 84.6% of scored vulnerabilities.
Not severe (CVSS 3.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 14 · Related 11Timeline
- 03-01-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
CVSS metrics
11 scores · 7 sources · 4 versions- OSV · AlpineEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · PypiEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · Red hatEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated5.3MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST3.1LowCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
2.48%
Chance of exploitation in the next 30 days
Percentile
85%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.48% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat8 products
- ansible≥ 2.5.0, < 2.5.14 | ≥ 2.6.0, < 2.6.11 | ≥ 2.7.0, < 2.7.5
- ansible_engine2.0 | 2.5 | 2.6 | 2.7
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
- enterprise_linux_workstation7.0
Alpine2 products
- ansible≥ 2.5.0, < 2.7.9-r0 | ≥ 2.5.0, < 2.5.14-r0 | ≥ 2.5.0, < 2.7.5-r0
- ansible-base< 2.7.9-r0
Debian2 products
- ansible< 2.7.6+dfsg-1
- debian_linuxEOL9.0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.04
Mageia1 product
- ansible< 2.4.6.0-1.2.mga6
PyPI1 product
- ansible< 2.5.14 | ≥ 2.6.0a1, < 2.6.11 | ≥ 2.7.0a1, < 2.7.5 | ≥ 2.7.0, < 2.7.5
Red hat1 product
- ansible< 2.5.14 | < 2.6.11 | < 2.7.5
Suse1 product
Ubuntu1 product
- ansible< 2.5.1+dfsg-1ubuntu0.1
9 vendors · 18 products
References
40 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16876X Refsource CONFIRMIssue TrackingPatchVendor AdvisoryWEBREPORT
www.debian.org/security/2019/dsa-4396Vendor AdvisoryX Refsource DEBIANThird Party AdvisoryWEBAdvisory
Show all 40 references
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.htmlVendor AdvisoryX Refsource SUSEThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.htmlVendor AdvisoryX Refsource SUSEThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.htmlVendor AdvisoryX Refsource SUSEThird Party AdvisoryWEB
- github.com/ansible/ansiblePACKAGE