CVE-2016-8647

Severity: medium (CVSS 4.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-26 · updated 2026-06-17
Weakness: CWE-20

Description

An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.

Affected products

RedHat Ansible Engine: before 2.2.1.0 — fixed in 2.2.1.0
RedHat Virtualization: 4.1

How to fix

Upgrade to a fixed version: RedHat Ansible Engine 2.2.1.0. Check the vendor advisory for mitigations.

References

https://access.redhat.com/errata/RHSA-2017:1685
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8647
https://github.com/ansible/ansible-modules-core/pull/5388
https://access.redhat.com/errata/RHSA-2017:1685
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8647
https://github.com/ansible/ansible-modules-core/pull/5388

Get alerted when CVE-2016-8647 or the next vulnerability affects your stack