Vulnerability CVE-2016-9587
Published: 2018-04-24

Description:
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

See advisories in our WLB2 database:
Topic
Author
Date
High
Ansible 2.1.4 / 2.2.1 Command Execution
Undisclosed at C...
12.01.2017

Type:

CWE-20

 (Improper Input Validation)

CVSS2 => (AV:N/AC:M/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
9.3/10
10/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Redhat -> Openstack 

 References:
http://rhn.redhat.com/errata/RHSA-2017-0195.html
http://rhn.redhat.com/errata/RHSA-2017-0260.html
http://www.securityfocus.com/bid/95352
https://access.redhat.com/errata/RHSA-2017:0448
https://access.redhat.com/errata/RHSA-2017:0515
https://access.redhat.com/errata/RHSA-2017:1685
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9587
https://security.gentoo.org/glsa/201701-77
https://www.exploit-db.com/exploits/41013/
Copyright 2024, cxsecurity.com

 

Back to Top