PT-2020-6675 · Red Hat+2 · Ansible Engine+2
Published
2020-01-28
·
Updated
2026-06-03
·
CVE-2019-14905
CVSS v3.1
7.3
High
| Vector | AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Ansible Engine versions 2.9.x before 2.9.3
Ansible Engine versions 2.8.x before 2.8.8
Ansible Engine versions 2.7.x before 2.7.16 and earlier
Description
The issue is related to the nxos file copy module in Ansible, which can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the
filename parameter to perform OS command injections, potentially resulting in a loss of confidentiality of the system among other issues.Recommendations
For Ansible Engine versions 2.9.x before 2.9.3, update to version 2.9.3 or later.
For Ansible Engine versions 2.8.x before 2.8.8, update to version 2.8.8 or later.
For Ansible Engine versions 2.7.x before 2.7.16 and earlier, update to version 2.7.16 or later.
As a temporary workaround, consider restricting the use of the
nxos file copy module until a patch is available.
Avoid using the filename parameter in the affected module to minimize the risk of exploitation.Fix
RCE
Exposure of Resource to Wrong Sphere
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Ansible Engine
Suse