8.0
High
CVE-2017-7466 Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems
Description
Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ansible | Versions not published |
Other CVEs of ansible
The 7 CVEs of ansible →
CVE-2019-14856
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
6.4
Medium
CVE-2018-16837
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen
7.8
High
CVE-2017-7481
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe
5.3
Medium
CVE-2018-10875
A flaw was found in ansible
7.8
High