rpm package
suse/ansible&distro=SUSE Package Hub 15
pkg:rpm/suse/ansible&distro=SUSE%20Package%20Hub%2015
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2019-3828 | — | < 2.7.8-bp150.3.6.1 | 2.7.8-bp150.3.6.1 | Mar 27, 2019 | Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path. | ||
| CVE-2018-16876 | — | < 2.7.8-bp150.3.6.1 | 2.7.8-bp150.3.6.1 | Jan 3, 2019 | ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data. | ||
| CVE-2018-16859 | — | < 2.7.8-bp150.3.6.1 | 2.7.8-bp150.3.6.1 | Nov 29, 2018 | Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the | ||
| CVE-2018-16837 | — | < 2.7.8-bp150.3.6.1 | 2.7.8-bp150.3.6.1 | Oct 23, 2018 | Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which h | ||
| CVE-2017-7481 | Cri | 9.8 | < 2.7.6-bp150.3.3.1 | 2.7.6-bp150.3.3.1 | Jul 19, 2018 | Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, | |
| CVE-2018-10875 | Hig | 7.8 | < 2.7.8-bp150.3.6.1 | 2.7.8-bp150.3.6.1 | Jul 13, 2018 | A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code. | |
| CVE-2018-10855 | Med | 5.9 | < 2.7.6-bp150.3.3.1 | 2.7.6-bp150.3.3.1 | Jul 3, 2018 | Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in | |
| CVE-2017-7466 | Hig | 8.0 | < 2.7.6-bp150.3.3.1 | 2.7.6-bp150.3.3.1 | Jun 22, 2018 | Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbi |
- CVE-2019-3828Mar 27, 2019affected < 2.7.8-bp150.3.6.1fixed 2.7.8-bp150.3.6.1
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
- CVE-2018-16876Jan 3, 2019affected < 2.7.8-bp150.3.6.1fixed 2.7.8-bp150.3.6.1
ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
- CVE-2018-16859Nov 29, 2018affected < 2.7.8-bp150.3.6.1fixed 2.7.8-bp150.3.6.1
Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the
- CVE-2018-16837Oct 23, 2018affected < 2.7.8-bp150.3.6.1fixed 2.7.8-bp150.3.6.1
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which h
- affected < 2.7.6-bp150.3.3.1fixed 2.7.6-bp150.3.3.1
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default,
- affected < 2.7.8-bp150.3.6.1fixed 2.7.8-bp150.3.6.1
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
- affected < 2.7.6-bp150.3.3.1fixed 2.7.6-bp150.3.3.1
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in
- affected < 2.7.6-bp150.3.3.1fixed 2.7.6-bp150.3.3.1
Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbi