ansible-core 2.11.0 vulnerabilities

Known vulnerabilities in the ansible-core package. This does not include vulnerabilities belonging to this package’s dependencies.

Vulnerability	Vulnerable Version
L Improper Input Validation ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy. Affected versions of this package are vulnerable to Improper Input Validation through the use of the `hostvars` object. Attackers can bypass unsafe content protections and execute templated content, leading to arbitrary code execution. This is only exploitable if attackers can modify the content returned to a play that utilizes `hostvars` to reference unsafe content How to fix Improper Input Validation? Upgrade `ansible-core` to version 2.18.0 or higher.	[,2.18.0)
M Incorrect Authorization ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy. Affected versions of this package are vulnerable to Incorrect Authorization through the `user` module. An attacker can modify or replace file contents and take ownership of files on any system path by exploiting directory traversal permissions. Note: This is only exploitable if someone with root privileges uses the `user` module with the `generate_ssh_key` option (disabled by default) and targets an unprivileged user. The unprivileged user needs to have traversal permissions on the directory containing the exploited target file. How to fix Incorrect Authorization? Upgrade `ansible-core` to version 2.14.18rc1, 2.15.13rc1, 2.16.13rc1, 2.17.6rc1, 2.18.0rc2 or higher.	[,2.14.18rc1)[2.15.0b1,2.15.13rc1)[2.16.0b1,2.16.13rc1)[2.17.0b1,2.17.6rc1)[2.18.0b1,2.18.0rc2)
M Exposure of Sensitive Information in Log Files ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy. Affected versions of this package are vulnerable to Exposure of Sensitive Information in Log Files when loading variables from Ansible Vault without setting `no_log: true`, which is the behavior of some tasks, including `include_vars`. This vulnerability can be exploited during the execution of a playbook. Note: This is a similar vulnerability to the previously reported CVE-2024-0690. How to fix Exposure of Sensitive Information in Log Files? Upgrade `ansible-core` to version 2.14.18rc1 or higher.	[,2.14.18rc1)
M Improper Output Neutralization for Logs ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs due to a failure to respect the `ANSIBLE_NO_LOG` configuration in some scenarios. This could allow an attacker to obtain sensitive information, such as decrypted secret values from the output of certain tasks, like loop items. How to fix Improper Output Neutralization for Logs? Upgrade `ansible-core` to version 2.14.14, 2.15.9, 2.16.3 or higher.	[,2.14.14)[2.15.0,2.15.9)[2.16.0,2.16.3)
M Improper Control of Generation of Code ('Code Injection') ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy. Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection'). An attacker can inject malicious code into the template, leading to unauthorized access and potential data compromise. How to fix Improper Control of Generation of Code ('Code Injection')? Upgrade `ansible-core` to version 2.15.7rc1, 2.16.1rc1 or higher.	[,2.15.7rc1)[2.16.0,2.16.1rc1)
M Command Injection ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy. Affected versions of this package are vulnerable to Command Injection. If a user is trying to put templates in multi-line yaml strings and the facts being handled don't routinely include special template characters, then their controller will be vulnerable to a template injection through the facts used in template. How to fix Command Injection? Upgrade `ansible-core` to version 2.11.2 or higher.	[,2.11.2)
M Race Condition ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy. Affected versions of this package are vulnerable to Race Condition. The `ANSIBLE_ASYNC_DIR` value defaults to `~/.ansible_async/` but is settable by the user. When this occurs, there is a race condition on the managed machine. A malicious, low privileged account on the remote machine can pre-create `/tmp/username-ansible-async` and then use various attacks to access the async result data. How to fix Race Condition? Upgrade `ansible-core` to version 2.12.0b1 or higher.	[,2.12.0b1)
M Symlink Attack ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy. Affected versions of this package are vulnerable to Symlink Attack via the `ansible-galaxy` function. When installing a maliciously created Ansible role using `ansible-galaxy role install`, arbitrary files the user has access to can be overwritten. The malicious role must contain a symlink with an absolute path to the target file, followed by a file of the same name (as the symlink) with the contents to write to the target. How to fix Symlink Attack? Upgrade `ansible-core` to version 2.13.13rc1, 2.14.11rc1, 2.15.5rc1, 2.16.0b2 or higher.	[,2.13.13rc1)[2.14.0,2.14.11rc1)[2.15.0,2.15.5rc1)[2.16.0b1,2.16.0b2)

Vulnerability

Vulnerable Version

Improper Input Validation

ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy.

Affected versions of this package are vulnerable to Improper Input Validation through the use of the hostvars object. Attackers can bypass unsafe content protections and execute templated content, leading to arbitrary code execution. This is only exploitable if attackers can modify the content returned to a play that utilizes hostvars to reference unsafe content

How to fix Improper Input Validation?

Upgrade ansible-core to version 2.18.0 or higher.

[,2.18.0)

Incorrect Authorization

Affected versions of this package are vulnerable to Incorrect Authorization through the user module. An attacker can modify or replace file contents and take ownership of files on any system path by exploiting directory traversal permissions.

Note:

This is only exploitable if someone with root privileges uses the user module with the generate_ssh_key option (disabled by default) and targets an unprivileged user. The unprivileged user needs to have traversal permissions on the directory containing the exploited target file.

How to fix Incorrect Authorization?

Upgrade ansible-core to version 2.14.18rc1, 2.15.13rc1, 2.16.13rc1, 2.17.6rc1, 2.18.0rc2 or higher.

[,2.14.18rc1)[2.15.0b1,2.15.13rc1)[2.16.0b1,2.16.13rc1)[2.17.0b1,2.17.6rc1)[2.18.0b1,2.18.0rc2)

Exposure of Sensitive Information in Log Files

Affected versions of this package are vulnerable to Exposure of Sensitive Information in Log Files when loading variables from Ansible Vault without setting no_log: true, which is the behavior of some tasks, including include_vars. This vulnerability can be exploited during the execution of a playbook.

Note:

This is a similar vulnerability to the previously reported CVE-2024-0690.

How to fix Exposure of Sensitive Information in Log Files?

Upgrade ansible-core to version 2.14.18rc1 or higher.

[,2.14.18rc1)

Improper Output Neutralization for Logs

Affected versions of this package are vulnerable to Improper Output Neutralization for Logs due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. This could allow an attacker to obtain sensitive information, such as decrypted secret values from the output of certain tasks, like loop items.

How to fix Improper Output Neutralization for Logs?

Upgrade ansible-core to version 2.14.14, 2.15.9, 2.16.3 or higher.

[,2.14.14)[2.15.0,2.15.9)[2.16.0,2.16.3)

Improper Control of Generation of Code ('Code Injection')

Affected versions of this package are vulnerable to Improper Control of Generation of Code ('Code Injection'). An attacker can inject malicious code into the template, leading to unauthorized access and potential data compromise.

How to fix Improper Control of Generation of Code ('Code Injection')?

Upgrade ansible-core to version 2.15.7rc1, 2.16.1rc1 or higher.

[,2.15.7rc1)[2.16.0,2.16.1rc1)

Command Injection

Affected versions of this package are vulnerable to Command Injection. If a user is trying to put templates in multi-line yaml strings and the facts being handled don't routinely include special template characters, then their controller will be vulnerable to a template injection through the facts used in template.

How to fix Command Injection?

Upgrade ansible-core to version 2.11.2 or higher.

[,2.11.2)

Race Condition

Affected versions of this package are vulnerable to Race Condition. The ANSIBLE_ASYNC_DIR value defaults to ~/.ansible_async/ but is settable by the user.

When this occurs, there is a race condition on the managed machine. A malicious, low privileged account on the remote machine can pre-create /tmp/username-ansible-async and then use various attacks to access the async result data.

How to fix Race Condition?

Upgrade ansible-core to version 2.12.0b1 or higher.

[,2.12.0b1)

Symlink Attack

Affected versions of this package are vulnerable to Symlink Attack via the ansible-galaxy function. When installing a maliciously created Ansible role using ansible-galaxy role install, arbitrary files the user has access to can be overwritten. The malicious role must contain a symlink with an absolute path to the target file, followed by a file of the same name (as the symlink) with the contents to write to the target.

How to fix Symlink Attack?

Upgrade ansible-core to version 2.13.13rc1, 2.14.11rc1, 2.15.5rc1, 2.16.0b2 or higher.

[,2.13.13rc1)[2.14.0,2.14.11rc1)[2.15.0,2.15.5rc1)[2.16.0b1,2.16.0b2)

ansible-core@2.11.0 vulnerabilities

Radically simple IT automation

latest version

latest non vulnerable version

first published

latest version published

licenses detected

Direct Vulnerabilities

How to fix?