Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 42

Export CSV
CVE-2020-10691

Ansible: archive traversal vulnerability in ansible-galaxy collection install

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Engine Ansible Tower
CVE-2020-10685

Ansible: modules which use files encrypted with vault are not properly cleaned up

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Ansible Engine Ansible Tower and 3 more
CVE-2020-10684

Ansible: code injection when using ansible_facts as a subkey

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Redhat
Products
Debian Linux Fedora Ansible and 3 more
CVE-2019-3828

Ansible: path traversal in the fetch module

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Ansible Engine Openstack
CVE-2019-14905

Ansible: malicious code could craft filename in nxos_file_copy module

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Opensuse Redhat
Products
Fedora Backports Sle Leap and 5 more
CVE-2019-14904

Ansible: vulnerability in solaris_zone module via crafted solaris zone

A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Ansible Ansible Engine
CVE-2019-14864

Ansible: Splunk and Sumologic callback plugins leak sensitive data in logs

Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Debian Opensuse Redhat
Products
Debian Linux Backports Sle Leap and 6 more
CVE-2019-14858

ansible: sub parameters marked as no_log are not masked in certain failure scenarios

A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Engine Ansible Tower Openstack
CVE-2019-14846

ansible: secrets disclosed on logs when no_log enabled

In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Opensuse Redhat
Products
Debian Linux Backports Sle Leap and 3 more
CVE-2019-10217

Ansible: gcp modules do not flag sensitive data fields properly

A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.

CVSS 3.1 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Ansible Ansible Engine
CVE-2019-10206

Ansible: disclosure data when prompted for password and template characters are passed

ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed
Vendors
Debian Opensuse Redhat
Products
Debian Linux Backports Sle Leap and 3 more
CVE-2019-10156

ansible: unsafe template evaluation of returned module data can lead to information disclosure

A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.

CVSS 3.1 · 5.4 Medium EPSS 1.8% KEV · Not listed
Vendors
Debian Redhat
Products
Debian Linux Ansible Ansible Engine and 1 more
CVE-2018-7750

python-paramiko: Authentication bypass in transport.py

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

CVSS 3.1 · 9.8 Critical EPSS 27.1% KEV · Not listed
Vendors
Debian Paramiko Redhat
Products
Debian Linux Paramiko Ansible Engine and 15 more
CVE-2018-16876

ansible: Information disclosure in vvv+ mode with no_log on

ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.

CVSS 3.1 · 5.3 Medium EPSS 2.5% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Ansible and 7 more
CVE-2018-16859

ansible: become password logged in plaintext when used with PowerShell on Windows

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.

CVSS 3.0 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Engine
CVE-2018-16837

Ansible: Information leak in "user" module

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Redhat Suse
Products
Debian Linux Ansible Engine Ansible Tower and 3 more
CVE-2018-10875

ansible: ansible.cfg is being read from current working directory allowing possible code execution

A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Redhat and 1 more
Products
Ubuntu Linux Debian Linux Ansible Engine and 9 more
CVE-2018-10874

ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Engine Enterprise Linux Openstack and 2 more
CVE-2018-10855

ansible: Failed tasks do not honour no_log option allowing for secrets to be disclosed in logs

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

CVSS 3.1 · 5.9 Medium EPSS 3.0% KEV · Not listed
Vendors
Canonical Debian Redhat
Products
Ubuntu Linux Debian Linux Ansible Engine and 5 more