PT-2019-5285 · Red Hat+6 · Ansible+6
Borja Tarraso
·
Publicado
2019-07-23
·
Atualizado
2026-06-03
·
CVE-2019-10206
CVSS v4.0
7.1
Alta
| Vetor | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Ansible versions 2.6.x through 2.6.18
Ansible versions 2.7.x through 2.7.12
Ansible versions 2.8.x through 2.8.3
Description
The issue is related to insufficient input validation in the Ansible configuration management system. This could allow a remote attacker to gain unauthorized access to protected information. The problem arises when using
ansible-playbook -k and Ansible CLI tools, where passwords are expanded from templates and may contain special characters, potentially triggering template execution and exposing the passwords.Recommendations
For Ansible versions 2.6.x through 2.6.18, update to version 2.6.19 or later.
For Ansible versions 2.7.x through 2.7.12, update to version 2.7.13 or later.
For Ansible versions 2.8.x through 2.8.3, update to version 2.8.4 or later.
Correção
RCE
Insufficiently Protected Credentials
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Ansible
Ansible-Core
Astra Linux
Linuxmint
Suse
Ubuntu