Search for packages
| purl | pkg:deb/ubuntu/ansible@1.7.1%2Bdfsg-1 |
| Next non-vulnerable version | 2.9.6+dfsg-1 |
| Latest non-vulnerable version | 2.9.6+dfsg-1 |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1puc-u4y9-aaap
Aliases: CVE-2019-14904 GHSA-gwr8-5j83-483c PYSEC-2020-161 PYSEC-2020-180 |
A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected. |
Affected by 1 other vulnerability. |
|
VCID-2989-kmjf-aaas
Aliases: CVE-2018-16876 GHSA-j569-fghw-f9rx PYSEC-2019-141 |
ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data. |
Affected by 15 other vulnerabilities. |
|
VCID-3tap-8hpn-aaad
Aliases: CVE-2019-10217 GHSA-p75j-wc34-527c PYSEC-2019-3 PYSEC-2019-73 |
A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks. |
Affected by 4 other vulnerabilities. |
|
VCID-4256-s7ta-aaar
Aliases: CVE-2018-16837 GHSA-hwrm-63v2-42g4 PYSEC-2018-44 |
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list. |
Affected by 8 other vulnerabilities. |
|
VCID-4tsx-tb15-aaar
Aliases: CVE-2019-10206 GHSA-cqmr-rcpr-cxh3 PYSEC-2019-145 |
ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them. |
Affected by 4 other vulnerabilities. |
|
VCID-5r5b-u8py-aaan
Aliases: CVE-2016-8614 GHSA-cmwx-9m2h-x7v4 PYSEC-2018-37 |
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key. |
Affected by 9 other vulnerabilities. |
|
VCID-66z9-6ea3-aaaf
Aliases: CVE-2019-3828 GHSA-74vq-h4q8-x6jv PYSEC-2019-5 PYSEC-2019-75 |
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path. |
Affected by 15 other vulnerabilities. |
|
VCID-9e5w-5m3m-aaaj
Aliases: CVE-2017-7481 GHSA-w578-j992-554x PYSEC-2018-41 |
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated. |
Affected by 9 other vulnerabilities. |
|
VCID-bdvq-5546-aaap
Aliases: CVE-2017-7466 GHSA-3m8p-xpm6-8ww3 PYSEC-2018-40 |
Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges. |
Affected by 20 other vulnerabilities. |
|
VCID-czq6-67wz-aaag
Aliases: CVE-2016-8628 GHSA-jg4f-jqm5-4mgq PYSEC-2018-38 |
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as. |
Affected by 20 other vulnerabilities. |
|
VCID-gz8m-3evh-aaar
Aliases: CVE-2014-2686 GHSA-49m5-2838-q2rv PYSEC-2020-198 |
Ansible prior to 1.5.4 mishandles the evaluation of some strings. |
Affected by 15 other vulnerabilities. |
|
VCID-k7vj-42hx-aaag
Aliases: CVE-2015-3908 GHSA-w64c-pxjj-h866 PYSEC-2015-1 |
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. |
Affected by 27 other vulnerabilities. |
|
VCID-m1j9-6xnm-aaac
Aliases: CVE-2019-14864 GHSA-3m93-m4q6-mc6v PYSEC-2020-160 PYSEC-2020-179 |
Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data. |
Affected by 3 other vulnerabilities. |
|
VCID-px3x-t4ay-aaaa
Aliases: CVE-2018-10875 GHSA-fc4h-467w-46rh PYSEC-2018-43 |
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code. |
Affected by 9 other vulnerabilities. |
|
VCID-q52e-x2mz-aaaa
Aliases: CVE-2016-8647 GHSA-x4cm-m36h-c6qj PYSEC-2018-58 |
An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed. |
Affected by 9 other vulnerabilities. |
|
VCID-qy3t-m3jq-aaad
Aliases: CVE-2019-10156 GHSA-grgm-pph5-j5h7 PYSEC-2019-2 PYSEC-2019-72 |
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed. |
Affected by 15 other vulnerabilities. |
|
VCID-scu2-mz1c-aaan
Aliases: CVE-2016-9587 GHSA-m956-frf4-m2wr PYSEC-2018-39 |
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges. |
Affected by 20 other vulnerabilities. |
|
VCID-sxuh-5a7s-aaap
Aliases: CVE-2016-3096 GHSA-rh6x-qvg7-rrmj PYSEC-2016-1 |
High severity vulnerability that affects ansible |
Affected by 24 other vulnerabilities. |
|
VCID-ucck-84n4-aaas
Aliases: CVE-2013-2233 GHSA-9x6q-5423-w5v9 PYSEC-2018-36 |
Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys. |
Affected by 25 other vulnerabilities. |
|
VCID-ucre-31md-aaad
Aliases: CVE-2019-14846 GHSA-pm48-cvv2-29q5 PYSEC-2019-4 PYSEC-2019-74 |
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process. |
Affected by 4 other vulnerabilities. |
|
VCID-vhdj-z1ew-aaap
Aliases: CVE-2017-7550 GHSA-588w-w6mv-3cw5 PYSEC-2017-4 |
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation. |
Affected by 20 other vulnerabilities. |
|
VCID-vpzy-gc78-aaag
Aliases: CVE-2018-10855 GHSA-jwcc-j78w-j73w PYSEC-2018-42 |
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible. |
Affected by 15 other vulnerabilities. |
|
VCID-wkkk-5njy-aaaa
Aliases: CVE-2019-14905 GHSA-frxj-5j27-f8rf PYSEC-2020-206 |
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues. |
Affected by 1 other vulnerability. |
|
VCID-wy7g-f3te-aaak
Aliases: CVE-2015-6240 GHSA-wwwh-47wp-m522 PYSEC-2017-3 |
The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack. |
Affected by 26 other vulnerabilities. |
|
VCID-yxbw-377b-aaan
Aliases: CVE-2020-10729 GHSA-r6h7-5pq2-j77h PYSEC-2021-105 |
A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6. |
Affected by 0 other vulnerabilities. |
|
VCID-yxyq-9868-aaaj
Aliases: CVE-2018-10874 GHSA-3xvg-x47j-x75w PYSEC-2018-81 |
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result. |
Affected by 9 other vulnerabilities. |
|
VCID-zk4f-r19r-aaap
Aliases: CVE-2019-14858 GHSA-h653-95qw-h2mp PYSEC-2019-171 |
A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task. |
Affected by 4 other vulnerabilities. |
|
VCID-zxh4-zrbz-aaaf
Aliases: CVE-2014-4967 GHSA-64cw-m57j-65xj PYSEC-2020-205 |
Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command. |
Affected by 9 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|