PT-2018-5036 · Red Hat+2 · Ansible+2

Adam Mariš · Publicado 2017-03-30 · Atualizado 2024-05-06 · CVE-2016-8628

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Crítica

Vetor base

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Ansible versions prior to 2.2.0

Description The issue arises from improper sanitization of fact variables sent from the Ansible controller. An attacker who can create special variables on the controller may be able to execute arbitrary commands on Ansible clients, running them as the user Ansible is set to run as.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue.

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

ALT-PU-2017-1386

CVE-2016-8628

GHSA-JG4F-JQM5-4MGQ

OPENSUSE-SU-2017:2976-1

OPENSUSE-SU-2017:2978-1

PYSEC-2018-38

RHSA-2016:2778

SUSE-SU-2020:3309-1

SUSE-SU-2024:1509-1

Produtos afetados

Alt Linux

Ansible

Ansible-Core

Referências · 149

• https://github.com/ansible/ansible · Nota
• https://github.com/ansible/ansible/issues/41903 · Nota
• https://github.com/ansible/ansible/commit/35938b907dfcd1106ca40b794f0db446bdb8cf09 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-38.yaml · Nota
• https://suse.com/security/cve/CVE-2020-10684 · Nota
• https://suse.com/security/cve/CVE-2019-14858 · Nota
• https://suse.com/security/cve/CVE-2018-10875 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2020:3309-1 · Aviso do Fabricante
• https://bugzilla.suse.com/1157969 · Nota
• https://bugzilla.suse.com/1167532 · Nota
• https://cve.org/CVERecord?id=CVE-2016-8628 · Nota de Segurança
• https://suse.com/security/cve/CVE-2019-14904 · Nota
• https://suse.com/security/cve/CVE-2020-14330 · Nota
• https://bugzilla.suse.com/1219002 · Nota
• https://suse.com/security/cve/CVE-2018-16876 · Nota