GHSA-jg4f-jqm5-4mgq
Suggest an improvement- Source
- https://github.com/advisories/GHSA-jg4f-jqm5-4mgq
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-jg4f-jqm5-4mgq/GHSA-jg4f-jqm5-4mgq.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-jg4f-jqm5-4mgq
- Aliases
- Published
- 2018-10-10T17:23:14Z
- Modified
- 2024-09-04T19:03:49.082081Z
- Severity
-
- 9.1 (Critical) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
- 9.4 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
- Summary
- Ansible fails to properly sanitize fact variables sent from the Ansible controller
- Details
-
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2016-8628
- https://github.com/ansible/ansible/issues/41903
- https://github.com/ansible/ansible/commit/35938b907dfcd1106ca40b794f0db446bdb8cf09
- https://access.redhat.com/errata/RHSA-2016:2778
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8628
- https://github.com/advisories/GHSA-jg4f-jqm5-4mgq
- https://github.com/ansible/ansible
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-38.yaml
- https://web.archive.org/web/20200227214455/http://www.securityfocus.com/bid/94109
Affected packages
PyPI / ansible
Package
- Name
- ansible
- View open source insights on deps.dev
- Purl
- pkg:pypi/ansible
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed2.2.0.0
Affected versions
1.*
1.0
1.1
1.2
1.2.1
1.2.2
1.2.3
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.4
1.4.1
1.4.2
1.4.3
1.4.4
1.4.5
1.5
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.6
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.6.10
1.7
1.7.1
1.7.2
1.8
1.8.1
1.8.2
1.8.3
1.8.4
1.9.0
1.9.0.1
1.9.1
1.9.2
1.9.3
1.9.4
1.9.5
1.9.6
2.*
2.0.0
2.0.0.0
2.0.0.1
2.0.0.2
2.0.1.0
2.0.2.0
2.1.0.0
2.1.1.0
2.1.2.0
2.1.3.0
2.1.4.0
2.1.5.0
2.1.6.0