SB2018073121 - Multiple vulnerabilities in Ansible

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018073121

SB2018073121 - Multiple vulnerabilities in Ansible

Published: July 31, 2018 Updated: August 8, 2020

Security Bulletin ID SB2018073121
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Key management errors (CVE-ID: CVE-2016-8614)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.


2) Command Injection (CVE-ID: CVE-2016-8628)

The vulnerability allows a remote privileged user to execute arbitrary code.

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.


Remediation

Install update from vendor's website.

References