Aller au contenu
en Se connecter
6.4 Moyenne

CVE-2025-57847 A container privilege escalation flaw was found in certain Ansible Automation Platform images

Description

A container privilege escalation flaw was found in certain Ansible Automation Platform images. This issue arises from the /etc/passwd file being created with group-writable permissions during the build process. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This vulnerability allows an attacker to add a new user with any arbitrary UID, including UID 0, gaining full root privileges within the container.

Produits et versions touchés

Produit Versions touchées Corrigé en
Red Hat Ansible Automation Platform 2 Versions non publiées
Red Hat Ansible Automation Platform 2.5 1789654540 premières → < 1789654540 1789654540
Red Hat Ansible Automation Platform Ansible Core 2 Versions non publiées
Red Hat Ansible Automation Platform 2.16 1789023765 premières → < 1789023765 1789023765
Red Hat Ansible Automation Platform 2.18 1789001715 premières → < 1789001715 1789001715
Red Hat Ansible Automation Platform 2.7 1789584820 premières → < 1789584820 1789584820
Red Hat Ansible Automation Platform 2.6 1789654312 premières → < 1789654312 1789654312

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Red Hat Ansible Automation Platform 2

Les 211 CVE de Red Hat Ansible Automation Platform 2 →
CVE-2026-123037 Ansible-core: user module generate_ssh_key follows a symlinked ~/.ssh enabling local privilege escalation (incomplete fix of cve-2024-9902) 6.7 Moyenne CVE-2026-114236 storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a… 3.3 Faible CVE-2026-109131 Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl) 5.4 Moyenne CVE-2026-92982 A flaw was found in Ansible Operator Plugins 8.5 Élevée
Suivre cette CVE