PT-2018-5036 · Red Hat+2 · Ansible+2

Adam Mariš · Published 2017-03-30 · Updated 2024-05-06 · CVE-2016-8628

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions Ansible versions prior to 2.2.0

Description The issue arises from improper sanitization of fact variables sent from the Ansible controller. An attacker who can create special variables on the controller may be able to execute arbitrary commands on Ansible clients, running them as the user Ansible is set to run as.

Recommendations For versions prior to 2.2.0, update to version 2.2.0 or later to resolve the issue.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

ALT-PU-2017-1386

CVE-2016-8628

GHSA-JG4F-JQM5-4MGQ

OPENSUSE-SU-2017:2976-1

OPENSUSE-SU-2017:2978-1

PYSEC-2018-38

RHSA-2016:2778

SUSE-SU-2020:3309-1

SUSE-SU-2024:1509-1

Affected Products

Alt Linux

Ansible

Ansible-Core

References · 149

• https://osv.dev/vulnerability/SUSE-SU-2020:3309-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-8628 · Security Note
• https://ubuntu.com/security/CVE-2016-8628 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8628 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-8628 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2016:2778 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:2978-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-8628 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1509-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8628 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-8628 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-38 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2017:2976-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-jg4f-jqm5-4mgq · Vendor Advisory
• https://github.com/ansible/ansible · Note