Homepage
About Snyk

Arbitrary Code Execution Affecting ansible package, versions [,1.6.6)

0.0
high

Snyk CVSS

    Attack Complexity Low
    Confidentiality High
    Integrity High
    Availability High

    Threat Intelligence

    EPSS 0.12% (45th percentile)
Expand this section
NVD
8.8 high

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-ANSIBLE-451465
  • published 3 Jul 2019
  • disclosed 8 Jun 2017
  • credit Michael Scherer (Red Hat)
Report a new vulnerability Found a mistake?

Introduced: 8 Jun 2017

CVE-2014-3498 Open this link in a new tab
CWE-20 Open this link in a new tab

How to fix?

Upgrade ansible to version 1.6.6 or higher.

Overview

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Arbitrary Code Execution. Ansible can get the result of remote command in variable, which may come from untrusted input source. The content of the variable isn't properly filtered and when attempting to use the variable, it will trigger a function that can lead to arbitrary command execution. Under certain circumstances, unprivileged user on system that is being managed via ansible can execute code on the managing host under UID of running ansible process.