ansible@1.3.0 vulnerabilities

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure where user credentials are disclosed by default in the traceback error message of set_options.

Upgrade ansible to version 2.9.27 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Arbitrary Code Execution in ansible.cfg which is read from the current working directory, can be altered to make it point to a plugin or a module path under the control of an attacker.

Upgrade ansible to version 2.5.6, 2.6.1 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Improper Input Validation via the safe_eval function which mishandles the evaluation of some strings.

Upgrade ansible to version 1.5.4 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the sources.list file that is used to construct filenames containing user and password fields. This might allow local users to obtain sensitive credential information by leveraging existence of a file that uses the deb http://user:pass@server:port/ format.

Upgrade ansible to version 1.5.5 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. The vault subsystem does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file.

Upgrade ansible to version 1.5.5 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Arbitrary Code Execution via arguments that are not sanitized, which in turn allows remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted Ansible fact, for example: (1) a trailing src= clause, (2) a trailing temp= clause, or (3) a trailing validate= clause accompanied by a shell command.

Upgrade ansible to version 1.6.7 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials. It sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@server:port/" format.

Upgrade ansible to version 1.5.5 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Remote Code Execution (RCE) via crafted lookup('pipe') calls or crafted Jinja2 data. The package does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings.

Upgrade ansible to version 1.6.7 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter to the module will cause the task to fail before the no_log configuration is processed, which may lead to the data being displayed.

Upgrade ansible to version 2.6.20, 2.7.14, 2.8.6 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Arbitrary Code Execution. It was found that inventory variables are loaded from current working directory when running ad-hoc commands which are under an attacker's control, allowing to run arbitrary code as a result.

Upgrade ansible to version 2.6.1, 2.5.6, 2.4.6.0 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Command Injection. If a user is trying to put templates in multi-line yaml strings and the facts being handled don't routinely include special template characters, then their controller will be vulnerable to a template injection through the facts used in template.

Upgrade ansible to version 2.9.23 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file.

Upgrade ansible to version 2.9.6 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. Logging with ansible is set at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

Upgrade ansible to version 2.9.12, 2.8.6, 2.10.0, 2.7.14 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. In several modules parameters containing credentials are being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker can take advantage of this information to steal those credentials, provided they have access to the log files containing them.

Upgrade ansible to version 2.8.20, 2.9.20 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. It leaks sensitive info such as secret values. This could lead in disclosing those credentials for every user which has access to the output of playbook execution.

Upgrade ansible to version 2.8.19, 2.9.18 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. The return value of a specific module i.e. basic.py of ansible engine is not being masked by default while using the fallback sub-option.The return value may contain sensitive info like secret Or Credentials.

Upgrade ansible to version 2.8.19, 2.9.18, 2.10.7 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. snmp_facts leaks user authentication such as authKey and privKey. This could lead in disclosing those credentials for every user which has access to the output of playbook execution.

Upgrade ansible to version 2.8.19, 2.9.18 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. A few different modules in Ansible-collection leaks sensitive data such as secret values. This could lead in disclosing those credentials for every user which has access to the output of playbook execution.

Upgrade ansible to version 2.8.19, 2.9.18 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. When using uri module keys are not properly masked and sensitive data is exposed into content and json output.

Upgrade ansible to version 2.8.14, 2.9.12 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. When using module_args, tasks executed with check mode (--check-mode) do not properly neutralize sensitive data which would be exposed in the event data. Unauthorized users would be able to read this data.

Upgrade ansible to version 2.8.14, 2.9.12 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Race Condition. This flaw refers to the incomplete fix for CVE-2020-1733 insecure temporary directory when running become_user from become directive. This vulnerability is not mitigated fully as there are race conditions from the original flaw could still happen on systems using ACLs and FUSE filesystems.

Upgrade ansible to version 2.9.10, 2.8.13 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Remote Code Execution (RCE). It allows using ansible _facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean.

Upgrade ansible to version 2.7.17, 2.8.9, 2.9.6 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Race Condition. A race condition flaw exists when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with umask 77 && mkdir -p <dir>;. This operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating /proc/<pid>/cmdline.

Upgrade ansible to version 2.7.17, 2.8.9, 2.9.6 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). A flaw was found when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.

Upgrade ansible to version 2.7.17, 2.8.9, 2.9.6 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Arbitrary Code Execution. Filenames in the nxos_file_copy module are used to perform actions to copy files to a flash or bootflash on NXOS devices. nxos_file_copy uses the remote_file parameter to determine the files destination. Malicious code could craft the filename parameter to take advantage of this by performing an OS command injection.

Upgrade ansible to version 2.9.3, 2.8.8, 2.7.16 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Arbitrary Code Injection. The solaris_zone module checks the status of the zone by executing an os.system() call and using the zone name as a parameter. A malicious user could provide a crafted zone name which allows commands to be executed into the server manipulating the module behaviour.

Upgrade ansible to version 2.9.4 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Improper Input Validation. The fix made in Ansible for CVE-2019-10206 was not sufficient to resolve the problem.

Upgrade ansible to version 2.8.6, 2.7.14, 2.6.20 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. It prompted passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.

Upgrade ansible to version 2.6.19, 2.7.13, 2.8.4 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. Splunk and Sumologic callback plugins leak sensitive data in logs.

Upgrade ansible to version 2.9.1, 2.8.7, 2.7.15 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Improper Input Validation. It didn't always succeed in changing a user's password. User's passwords sometimes failed to change without telling the user, The meaning of it is that old passwords might still be active when they should have been modified.

Upgrade ansible to version 2.2.1.0 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Arbitrary Code Execution. Ansible can get the result of remote command in variable, which may come from untrusted input source. The content of the variable isn't properly filtered and when attempting to use the variable, it will trigger a function that can lead to arbitrary command execution. Under certain circumstances, unprivileged user on system that is being managed via ansible can execute code on the managing host under UID of running ansible process.

Upgrade ansible to version 1.6.6 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. A flaw was discovered in the way the returned module data is handled which may cause information disclosure. This was due to templating causing an unexpected key file to be set on a remote node.

Upgrade ansible to version 2.6.18, 2.8.2, 2.7.12 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. When a retry task run with -vvv fails, it would log the raw return code, stdout and stderr from ssh which could have contained sensitive data.

Upgrade ansible to version 2.5.14, 2.6.11, 2.7.5 or higher.

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. Execution of ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for passwords to appear in EventLogs in plaintext. A malicious user with administrator privileges on the machine can view these logs and discover the plaintext password.

Upgrade ansible to version 2.5.12, 2.6.9, 2.7.3 or higher.

ansible is a radically simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. The User module would leak any data which is passed on as a parameter to ssh-keygen.

Upgrade ansible to version 2.7.1 or higher.

ansible is a radically simple IT automation system.

Affected versions of this package are vulnerable to Arbitrary Code Execution. It fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution.

Upgrade ansible to version 2.3.1.0, 2.4.0.0 or higher.

ansible is a radically simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. If nodes become offline during the build, the no_log attribute of a task got ignored. If the unreachable error occurred in a task used with a loop variable, the contents of the loop items would be printed in the console. This could lead to accidentally leaking credentials or secrets.

Upgrade ansible to version 2.5.5 or higher.

ansible is a Radically simple IT automation Affected versions of this package are vulnerable to Arbitrary Command Execution. If an attacker has control over an Ansible client, they could send facts back to the Ansible Server and exploit this to run code on the server.

ansible is a Radically simple IT automation Affected versions of this package are vulnerable to Arbitrary command Injection due to failing to properly sanitize fact variables sent from the Ansible controller. Any user with the ability to create special variables on the controller could exploit this vulnerability, running with the user Ansible runs as.

ansible is a Radically simple IT automation Affected versions of this package are vulnerable to Arbitrary Code Execution due to an incomplete fix for CVE-2014-4657.

ansible is a Radically simple IT automation Affected versions of this package are vulnerable to a Symlink Attack due to enabling a malicious zone/chroot/jail managed by ansible to escape into the managing host.

ansible is a Radically simple IT automation Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.