CVE-2016-8647

low-risk

Published 2018-07-26

An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.

Do I need to act?

0.17% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.9/10 Medium

NETWORK / LOW complexity

Affected Products (2)

Ansible Engine

Virtualization

Affected Vendors

Redhat

References (6)

Vendor Advisory https://access.redhat.com/errata/RHSA-2017:1685

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8647

Third Party Advisory https://github.com/ansible/ansible-modules-core/pull/5388

Vendor Advisory https://access.redhat.com/errata/RHSA-2017:1685

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8647

Third Party Advisory https://github.com/ansible/ansible-modules-core/pull/5388

/ 100

low-risk

Severity 20/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 7/34 · Low