VYPR
← All advisories
High severityNVD Advisory· Published Aug 25, 2020· Updated Aug 5, 2024

CVE-2019-14904

CVE-2019-14904

Description

A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

CVE-2019-14904 is a command injection vulnerability in Ansible's solaris_zone module due to insufficient validation of zone names.

Vulnerability

Description

The vulnerability resides in the solaris_zone module from the Ansible Community modules. When setting the name for a zone on a Solaris host, the module checks the zone name by listing processes with the ps bare command on the remote machine. No input validation is performed on the zone name, allowing an attacker to inject arbitrary commands by crafting a malicious zone name [1][2].

Exploitation

An attacker with the ability to specify a zone name (e.g., through a playbook or ad-hoc command) can inject shell metacharacters into the name. The module executes the ps command with the unsanitized zone name, leading to command injection on the remote Solaris host. No authentication is required beyond the privileges needed to run Ansible tasks on the target [1][2].

Impact

Successful exploitation allows an attacker to execute arbitrary commands on the remote host with the privileges of the Ansible process. This can lead to full compromise of the Solaris system, including data exfiltration, installation of backdoors, or lateral movement within the network [1][2].

Mitigation

The vulnerability affects Ansible Engine versions 2.7.15, 2.8.7, 2.9.2, and earlier. A fix was implemented in pull request #65686, which adds input validation to restrict zone names to valid characters as per Solaris Zone documentation [4]. Users should upgrade to patched versions or apply the workaround of manually validating zone names before use [1][4].

References
  1. NVD - CVE-2019-14904
  2. CVE-2019-14904 - GitHub Advisory Database
  3. solaris_zone: Allow only valid characters in zone name by Akasurde · Pull Request #65686 · ansible/ansible

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ansiblePyPI
< 2.7.162.7.16
ansiblePyPI
>= 2.8.0a1, < 2.8.82.8.8
ansiblePyPI
>= 2.9.0a1, < 2.9.32.9.3

Affected products

148

Patches

3
a1b0f72c98b4

[2.9] solaris_zone: Allow only valid characters in zone name

https://github.com/ansible/ansibleAbhijeet KasurdeDec 10, 2019via ghsa
commit
2 files changed · +15 −0
  • changelogs/fragments/solaris_zone_name_fix.yml+5 −0 added
    @@ -0,0 +1,5 @@
+bugfixes:
+- "**SECURITY** - CVE-2019-14904 - solaris_zone module accepts zone name and performs actions related to that.
+   However, there is no user input validation done while performing actions. A malicious user could provide a
+   crafted zone name which allows executing commands into the server manipulating the module behaviour. Adding
+   user input validation as per Solaris Zone documentation fixes this issue."
  • lib/ansible/modules/system/solaris_zone.py+10 −0 modified
    @@ -43,6 +43,10 @@
   name:
     description:
       - Zone name.
+      - A zone name must be unique name.
+      - A zone name must begin with an alpha-numeric character.
+      - The name can contain alpha-numeric characters, underbars I(_), hyphens I(-), and periods I(.).
+      - The name cannot be longer than 64 characters.
     type: str
     required: true
   path:
@@ -147,6 +151,7 @@
 
 import os
 import platform
+import re
 import tempfile
 import time
 
@@ -183,6 +188,11 @@ def __init__(self, module):
         if int(self.os_minor) < 10:
             self.module.fail_json(msg='This module requires Solaris 10 or later')
 
+        match = re.match('^[a-zA-Z0-9][-_.a-zA-Z0-9]{0,62}$', self.name)
+        if not match:
+            self.module.fail_json(msg="Provided zone name is not a valid zone name. "
+                                      "Please refer documentation for correct zone name specifications.")
+
     def configure(self):
         if not self.path:
             self.module.fail_json(msg='Missing required argument: path')
589a415f887b

[2.8] solaris_zone: Allow only valid characters in zone name

https://github.com/ansible/ansibleAbhijeet KasurdeDec 10, 2019via ghsa
commit
2 files changed · +15 −0
  • changelogs/fragments/solaris_zone_name_fix.yml+5 −0 added
    @@ -0,0 +1,5 @@
+bugfixes:
+- "**SECURITY** - CVE-2019-14904 - solaris_zone module accepts zone name and performs actions related to that.
+   However, there is no user input validation done while performing actions. A malicious user could provide a
+   crafted zone name which allows executing commands into the server manipulating the module behaviour. Adding
+   user input validation as per Solaris Zone documentation fixes this issue."
  • lib/ansible/modules/system/solaris_zone.py+10 −0 modified
    @@ -43,6 +43,10 @@
   name:
     description:
       - Zone name.
+      - A zone name must be unique name.
+      - A zone name must begin with an alpha-numeric character.
+      - The name can contain alpha-numeric characters, underbars I(_), hyphens I(-), and periods I(.).
+      - The name cannot be longer than 64 characters.
     type: str
     required: true
   path:
@@ -147,6 +151,7 @@
 
 import os
 import platform
+import re
 import tempfile
 import time
 
@@ -183,6 +188,11 @@ def __init__(self, module):
         if int(self.os_minor) < 10:
             self.module.fail_json(msg='This module requires Solaris 10 or later')
 
+        match = re.match('^[a-zA-Z0-9][-_.a-zA-Z0-9]{0,62}$', self.name)
+        if not match:
+            self.module.fail_json(msg="Provided zone name is not a valid zone name. "
+                                      "Please refer documentation for correct zone name specifications.")
+
     def configure(self):
         if not self.path:
             self.module.fail_json(msg='Missing required argument: path')
6a86650109b8

[2.7] solaris_zone: Allow only valid characters in zone name

https://github.com/ansible/ansibleAbhijeet KasurdeDec 10, 2019via ghsa
commit
2 files changed · +16 −0
  • changelogs/fragments/solaris_zone_name_fix.yml+5 −0 added
    @@ -0,0 +1,5 @@
+bugfixes:
+- "**SECURITY** - CVE-2019-14904 - solaris_zone module accepts zone name and performs actions related to that.
+   However, there is no user input validation done while performing actions. A malicious user could provide a
+   crafted zone name which allows executing commands into the server manipulating the module behaviour. Adding
+   user input validation as per Solaris Zone documentation fixes this issue."
  • lib/ansible/modules/system/solaris_zone.py+11 −0 modified
    @@ -41,6 +41,11 @@
   name:
     description:
       - Zone name.
+      - A zone name must be unique name.
+      - A zone name must begin with an alpha-numeric character.
+      - The name can contain alpha-numeric characters, underbars I(_), hyphens I(-), and periods I(.).
+      - The name cannot be longer than 64 characters.
+    type: str
     required: true
   path:
     description:
@@ -137,6 +142,7 @@
 
 import os
 import platform
+import re
 import tempfile
 import time
 
@@ -173,6 +179,11 @@ def __init__(self, module):
         if int(self.os_minor) < 10:
             self.module.fail_json(msg='This module requires Solaris 10 or later')
 
+        match = re.match('^[a-zA-Z0-9][-_.a-zA-Z0-9]{0,62}$', self.name)
+        if not match:
+            self.module.fail_json(msg="Provided zone name is not a valid zone name. "
+                                      "Please refer documentation for correct zone name specifications.")
+
     def configure(self):
         if not self.path:
             self.module.fail_json(msg='Missing required argument: path')

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

10

News mentions

0

No linked articles in our index yet.