Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-9587 — Improper Input Validation in Ansible

CWE-20 — Improper Input Validation17 documents8 sources
Severity
8.1HIGHNVD
EPSS
4.1%
top 11.43%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Redhat AnsibleAnsibleRedhat Openstack
Timeline
PublishedApr 24
Latest updateOct 10

Description

Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 2.2 | Impact: 5.9

Affected Packages5 packages

▶NVDredhat/ansible< 2.1.4
▶PyPIredhat/ansible2.2.0.0 — 2.2.1.0+1
▶NVDansible/ansible< 2.2.1
▶Debianredhat/ansible< 2.2.0.0-3+3

🔴Vulnerability Details

4
GHSA
Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems↗2018-10-10
▶
OSV
Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems↗2018-10-10
▶
CVEList
CVE-2016-9587: Ansible before versions 2↗2018-04-24
▶
OSV
CVE-2016-9587: Ansible before versions 2↗2018-04-24
▶

💥Exploits & PoCs

1
Exploit-DB
Ansible 2.1.4/2.2.1 - Command Execution↗2017-01-09
▶

📋Vendor Advisories

3
Red Hat
ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587)↗2017-04-11
▶
Red Hat
Ansible: Compromised remote hosts can lead to running commands on the Ansible controller↗2017-01-09
▶
Debian
CVE-2016-9587: ansible - Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validati...↗2016
▶

💬Community

8
Bugzilla
CVE-2017-7466 ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587) [epel-all]↗2017-04-11
▶
Bugzilla
CVE-2017-7466 ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587) [fedora-all]↗2017-04-11
▶
Bugzilla
CVE-2017-7466 ansible1.9: ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587) [epel-all]↗2017-04-11
▶
Bugzilla
CVE-2017-7466 ansible1.9: ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587) [fedora-all]↗2017-04-11
▶
Bugzilla
CVE-2017-7466 ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587)↗2017-04-05
▶
CVE-2016-9587 — Improper Input Validation in Ansible | cvebase