7.8
Élevée
CVE-2018-10875 A flaw was found in ansible
Description
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| ansible | Versions non publiées |
Références
- RHSA-2018:2166 access.redhat.com
- RHSA-2018:2152 access.redhat.com
- RHSA-2018:2150 access.redhat.com
- 1041396 www.securitytracker.com
- bugzilla.redhat.com bugzilla.redhat.com
- RHBA-2018:3788 access.redhat.com
- RHSA-2019:0054 access.redhat.com
- RHSA-2018:2151 access.redhat.com
- RHSA-2018:2321 access.redhat.com
- RHSA-2018:2585 access.redhat.com
- DSA-4396 www.debian.org
- openSUSE-SU-2019:1125 lists.opensuse.org
- USN-4072-1 usn.ubuntu.com
- [debian-lts-announce] 20190916 [SECURITY] [DLA 1923-1] ansible security update lists.debian.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de ansible
Les 7 CVE de ansible →
CVE-2019-14856
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
6.4
Moyenne
CVE-2018-16837
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen
7.8
Élevée
CVE-2017-7481
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe
5.3
Moyenne
CVE-2018-10855
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks
5.9
Moyenne