Red Hat Ansible
At a glance
- Source
- NVD
- EPSS
- EPSS 3.21 % · percentile 88 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
Weaknesses (CWE)
- CWE-77 — Improper Neutralization of Special Elements used in a Command
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.6 | CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H | redhat |
| CVSS 3.0 | HIGH 7.6 | CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.0 | CRITICAL 9.1 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-jg4f-jqm5-4mgq — Ansible fails to properly sanitize fact variables sent from the Ansible controller
- PYSEC-2018-38 — Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variable
European references
- ENISA EUVD · EUVD-2018-0011
- GCVE · GCVE-0-2016-8628
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*< 2.2.0
Affected products
| Product | Versions |
|---|---|
| Red Hat · Ansible | affected 2.2.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |