x/vulndb: potential Go vuln in github.com/ansible/ansible: CVE-2018-16876

[tatianab]

CVE-2018-16876 references github.com/ansible/ansible, which may be a Go module.

Description:
ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2018-16876
• web: https://access.redhat.com/errata/RHSA-2018:3838
• web: https://access.redhat.com/errata/RHSA-2019:0564
• web: http://www.securityfocus.com/bid/106225
• web: https://access.redhat.com/errata/RHSA-2018:3836
• web: https://access.redhat.com/errata/RHSA-2018:3835
• fix: ensure ssh retry respects no log ansible/ansible#49569
• web: https://access.redhat.com/errata/RHSA-2018:3837
• web: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16876
• web: https://www.debian.org/security/2019/dsa-4396
• web: https://access.redhat.com/errata/RHSA-2019:0590
• web: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html
• web: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html
• web: https://usn.ubuntu.com/4072-1/
• web: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html
• Imported by: https://pkg.go.dev/github.com/ansible/ansible?tab=importedby

Cross references:
No existing reports found with this module or alias.

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/ansible/ansible
      vulnerable_at: 2.15.5+incompatible
      packages:
        - package: ansible
cves:
    - CVE-2018-16876
references:
    - web: https://access.redhat.com/errata/RHSA-2018:3838
    - web: https://access.redhat.com/errata/RHSA-2019:0564
    - web: http://www.securityfocus.com/bid/106225
    - web: https://access.redhat.com/errata/RHSA-2018:3836
    - web: https://access.redhat.com/errata/RHSA-2018:3835
    - fix: https://github.com/ansible/ansible/pull/49569
    - web: https://access.redhat.com/errata/RHSA-2018:3837
    - web: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16876
    - web: https://www.debian.org/security/2019/dsa-4396
    - web: https://access.redhat.com/errata/RHSA-2019:0590
    - web: http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html
    - web: http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html
    - web: https://usn.ubuntu.com/4072-1/
    - web: http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html

[gopherbot]

Change https://go.dev/cl/540721 mentions this issue: data/excluded: batch add 135 excluded reports