GitHub Advisoryadvisory · PyPI

GHSA-m956-frf4-m2wr Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems

CRITICAL Published 2018-10-10 Modified 2024-11-18 Official page ↗
Aliases
CVE-2016-9587
Ecosystem
PyPI
Packages
ansible
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20
Reviewed
2020-06-16

Affected packages

• PyPI ansible: < 2.1.4.0 → fixed in 2.1.4.0 • PyPI ansible: >= 2.2.0.0, < 2.2.1.0 → fixed in 2.2.1.0

Description

Ansible before versions 2.1.4.0, 2.2.1.0 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

Related

Alias · CVE (1)

  • CVE-2016-9587 Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References