GHSA-jg4f-jqm5-4mgq
Ansible fails to properly sanitize fact variables sent from the Ansible controller
At a glance
- Published
- Updated
- CVE
- CVE-2016-8628
- Aliases
- PYSEC-2018-38
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Description
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
Affected packages
| Package | Versions |
|---|---|
| PyPI · ansible | introduced 0, fixed 2.2.0.0 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2016-8628 ADVISORY
- https://github.com/ansible/ansible/issues/41903 WEB
- https://github.com/ansible/ansible/commit/35938b907dfcd1106ca40b794f0db446bdb8cf09 WEB
- https://access.redhat.com/errata/RHSA-2016:2778 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8628 WEB
- https://github.com/advisories/GHSA-jg4f-jqm5-4mgq ADVISORY
- https://github.com/ansible/ansible PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-38.yaml WEB
- https://web.archive.org/web/20200227214455/http://www.securityfocus.com/bid/94109 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |