Arbitrary Code Execution Affecting ansible package, versions [2.6.0,2.6.1) [2.5.0,2.5.6) [,2.4.6.0)
Threat Intelligence
EPSS
0.08% (34th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-ANSIBLE-1570419
- published 27 Aug 2021
- disclosed 2 Jul 2018
- credit Unknown
Introduced: 2 Jul 2018
CVE-2018-10874 Open this link in a new tabHow to fix?
Upgrade ansible to version 2.6.1, 2.5.6, 2.4.6.0 or higher.
Overview
ansible is a simple IT automation system.
Affected versions of this package are vulnerable to Arbitrary Code Execution. It was found that inventory variables are loaded from current working directory when running ad-hoc commands which are under an attacker's control, allowing to run arbitrary code as a result.
CVSS Scores
version 3.1