PyPI package
ansible
pkg:pypi/ansible
Vulnerabilities (66)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-10217 | — | >= 2.8.0a1, < 2.8.4 | 2.8.4 | Nov 25, 2019 | A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. An | ||
| CVE-2019-10206 | — | >= 2.8.0, < 2.8.4 | 2.8.4 | Nov 22, 2019 | ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger an | ||
| CVE-2019-14858 | — | >= 2.9.0a1, < 2.9.0rc4 | 2.9.0rc4 | Oct 14, 2019 | A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub par | ||
| CVE-2019-14846 | — | < 2.6.20 | 2.6.20 | Oct 8, 2019 | In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not af | ||
| CVE-2019-10156 | — | < 2.6.18 | 2.6.18 | Jul 30, 2019 | A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any | ||
| CVE-2019-3828 | — | < 2.5.15 | 2.5.15 | Mar 27, 2019 | Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path. | ||
| CVE-2018-16876 | — | < 2.5.14 | 2.5.14 | Jan 3, 2019 | ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data. | ||
| CVE-2018-16859 | — | >= 2.7.0a1, < 2.7.3 | 2.7.3 | Nov 29, 2018 | Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the | ||
| CVE-2018-16837 | — | >= 2.7.0a1, < 2.7.1 | 2.7.1 | Oct 23, 2018 | Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which h | ||
| CVE-2016-8614 | Med | 6.3 | < 2.2.0.0 | 2.2.0.0 | Jul 31, 2018 | A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key. | |
| CVE-2016-8628 | Hig | 7.6 | < 2.2.0.0 | 2.2.0.0 | Jul 31, 2018 | Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as. | |
| CVE-2016-8647 | Med | 4.9 | < 2.2.1.0 | 2.2.1.0 | Jul 26, 2018 | An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed. | |
| CVE-2017-7481 | Cri | 9.8 | >= 2.3.0.0, < 2.3.1.0 | 2.3.1.0 | Jul 19, 2018 | Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, | |
| CVE-2018-10875 | Hig | 7.8 | < 2.4.6.0 | 2.4.6.0 | Jul 13, 2018 | A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code. | |
| CVE-2018-10855 | Med | 5.9 | >= 2.5.0a1, < 2.5.5 | 2.5.5 | Jul 3, 2018 | Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in | |
| CVE-2018-10874 | Hig | 7.8 | < 2.4.6.0 | 2.4.6.0 | Jul 2, 2018 | In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result. | |
| CVE-2017-7466 | Hig | 8.0 | < 2.2.3.0 | 2.2.3.0 | Jun 22, 2018 | Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbi | |
| CVE-2013-2233 | Hig | 7.4 | < 1.2.1 | 1.2.1 | May 4, 2018 | Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys. | |
| CVE-2016-9587 | Hig | 8.1 | < 2.1.4.0 | 2.1.4.0 | Apr 24, 2018 | Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use thi | |
| CVE-2017-7550 | Cri | 9.8 | >= 2.4.0.0, < 2.4.1.0 | 2.4.1.0 | Nov 21, 2017 | A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords t |
- CVE-2019-10217Nov 25, 2019affected >= 2.8.0a1, < 2.8.4fixed 2.8.4
A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. An
- CVE-2019-10206Nov 22, 2019affected >= 2.8.0, < 2.8.4fixed 2.8.4
ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger an
- CVE-2019-14858Oct 14, 2019affected >= 2.9.0a1, < 2.9.0rc4fixed 2.9.0rc4
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub par
- CVE-2019-14846Oct 8, 2019affected < 2.6.20fixed 2.6.20
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not af
- CVE-2019-10156Jul 30, 2019affected < 2.6.18fixed 2.6.18
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any
- CVE-2019-3828Mar 27, 2019affected < 2.5.15fixed 2.5.15
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
- CVE-2018-16876Jan 3, 2019affected < 2.5.14fixed 2.5.14
ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
- CVE-2018-16859Nov 29, 2018affected >= 2.7.0a1, < 2.7.3fixed 2.7.3
Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the
- CVE-2018-16837Oct 23, 2018affected >= 2.7.0a1, < 2.7.1fixed 2.7.1
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which h
- affected < 2.2.0.0fixed 2.2.0.0
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
- affected < 2.2.0.0fixed 2.2.0.0
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
- affected < 2.2.1.0fixed 2.2.1.0
An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.
- affected >= 2.3.0.0, < 2.3.1.0fixed 2.3.1.0
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default,
- affected < 2.4.6.0fixed 2.4.6.0
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
- affected >= 2.5.0a1, < 2.5.5fixed 2.5.5
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in
- affected < 2.4.6.0fixed 2.4.6.0
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
- affected < 2.2.3.0fixed 2.2.3.0
Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbi
- affected < 1.2.1fixed 1.2.1
Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.
- affected < 2.1.4.0fixed 2.1.4.0
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use thi
- affected >= 2.4.0.0, < 2.4.1.0fixed 2.4.1.0
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords t
Page 3 of 4