Red Hat Ansible
En bref
- Source
- NVD
- EPSS
- EPSS 3.21 % · centile 88 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Rechercher sur…
Description
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
Faiblesses (CWE)
- CWE-77 — Injection de commande
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.6 | CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H | redhat |
| CVSS 3.0 | HIGH 7.6 | CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.0 | CRITICAL 9.1 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-jg4f-jqm5-4mgq — Ansible fails to properly sanitize fact variables sent from the Ansible controller
- PYSEC-2018-38 — Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variable
Références européennes
- ENISA EUVD · EUVD-2018-0011
- GCVE · GCVE-0-2016-8628
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*< 2.2.0
Produits affectés
| Produit | Versions |
|---|---|
| Red Hat · Ansible | affected 2.2.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |