PT-2018-2340 · Red Hat+1 · Ansible+1

Adam Mariš · Publicado 2018-06-29 · Atualizado 2026-06-03 · CVE-2018-10875

Positive Technologies (AI Summary)

CVSS v4.0

8.5

Alta

Vetor base

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ansible (affected versions not specified)

Description A flaw in ansible allows an attacker to execute arbitrary code by altering the ansible.cfg file in the current working directory to point to a plugin or module path under their control. This can be exploited remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Untrusted Search Path

Enumeração de Fraquezas

CWE-426

Identificadores relacionados

BDU:2019-00506

CVE-2018-10875

DLA-1923-1

DSA-4396-1

GHSA-FC4H-467W-46RH

MGASA-2018-0439

OPENSUSE-SU-2019:0238-1

OPENSUSE-SU-2019:1125-1

OPENSUSE-SU-2022:0081-1

OPENSUSE-SU-2024:10615-1

OPENSUSE-SU-2024:14244-1

OPENSUSE-SU-2024:14536-1

OPENSUSE-SU-2025:15605-1

OPENSUSE-SU-2025:15753-1

OPENSUSE-SU-2026:10944-1

PYSEC-2018-43

RHSA-2018:2150

RHSA-2018:2151

RHSA-2018:2152

RHSA-2018:2166

RHSA-2018:2321

RHSA-2018:2585

RHSA-2019:0054

SUSE-SU-2018:4130-1

SUSE-SU-2020:3309-1

USN-4072-1

Produtos afetados

Ubuntu

Ansible

Referências · 200

• https://github.com/ansible/ansible · Nota
• https://github.com/ansible/ansible/blob/stable-2.4/CHANGELOG.md · Nota
• https://github.com/ansible/ansible/commit/f32c42c37aaf7b9db93ea3151b2f42a0c4bd8172 · Nota
• https://github.com/ansible/ansible/commit/4cecbe81adbc655d7ab734165d3ac539f8ba5981 · Nota
• https://github.com/ansible/ansible/issues/42388 · Nota
• https://github.com/ansible/ansible/commit/ff980afefdbe4ceb828bdb1bb2eef03cf616bf63 · Nota
• https://github.com/ansible/ansible/pull/42070 · Nota
• https://github.com/ansible/ansible/pull/43583 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-43.yaml · Nota
• https://suse.com/security/cve/CVE-2020-10684 · Nota
• https://suse.com/security/cve/CVE-2019-14858 · Nota
• https://suse.com/security/cve/CVE-2018-10875 · Nota
• https://access.redhat.com/errata/RHSA-2018:2585 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2020:3309-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2014-4966 · Nota