Debian Ansible vulnerabilities

CVE-2020-10684 [HIGH] CVE-2020-10684: ansible - A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to... A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users

CVE-2017-7481 [CRITICAL] CVE-2017-7481: ansible - Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin... Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated. Scope:

CVE-2016-9587 [HIGH] CVE-2016-9587: ansible - Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validati... Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges

CVE-2014-4657 [CRITICAL] CVE-2014-4657: ansible - The safe_eval function in Ansible before 1.5.4 does not properly restrict the co... The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. Scope: local bookworm: resolved (fixed in 1.5.5+dfsg-1) bullseye: resolved (fixed in 1.5.5+dfsg-1) forky: resolved (fixed in 1.5.5+dfsg-1) sid: resolved (fixed in 1.5.5+dfsg-1) trixie: resolved

CVE-2014-4967 [CRITICAL] CVE-2014-4967: ansible - Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote... Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command. Scope:

CVE-2014-4678 [CRITICAL] CVE-2014-4678: ansible - The safe_eval function in Ansible before 1.6.4 does not properly restrict the co... The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657. Scope: local bookworm: resolved (fixed in 1.6.6+dfsg-1) bullseye: resolved (fixed in 1.6.6+dfsg-1) forky: resolve

CVE-2014-4966 [CRITICAL] CVE-2014-4966: ansible - Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" subs... Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data. Scope: local bookworm: resolved (fixed in 1.6.8+dfsg-1) bullseye: resolved (fixed in 1.6.8+dfsg-1) for

CVE-2014-3498 [HIGH] CVE-2014-3498: ansible - The user module in ansible before 1.6.6 allows remote authenticated users to exe... The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands. Scope: local bookworm: resolved (fixed in 1.7.0+dfsg-1) bullseye: resolved (fixed in 1.7.0+dfsg-1) forky: resolved (fixed in 1.7.0+dfsg-1) sid: resolved (fixed in 1.7.0+dfsg-1) trixie: resolved (fixed in 1.7.0+dfsg-1)

CVE-2016-8628 [HIGH] CVE-2016-8628: ansible - Ansible before version 2.2.0 fails to properly sanitize fact variables sent from... Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as. Scope: local bookworm: resolved (fixed in 2.2.0.0-1) bullseye: resolved (fixed in 2.2.0.0-1) forky: resolved

CVE-2017-7550 [CRITICAL] CVE-2017-7550: ansible - A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1)... A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

CVE-2017-7466 [HIGH] CVE-2017-7466: ansible - Ansible before version 2.3 has an input validation vulnerability in the handling... Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges. Scope: local bookwor

CVE-2022-3697 [HIGH] CVE-2022-3697: ansible - A flaw was found in Ansible in the amazon.aws collection when using the tower_ca... A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs. Scope: local bookworm: resolved (fixed in 7.0.0+dfsg-1) bullseye: resolved

CVE-2021-20228 [HIGH] CVE-2021-20228: ansible - A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not maske... A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when using the sub-option feature of the basic.py module. This flaw allows an attacker to obtain sensitive information. The highest threat from this vulnerability is to confidentiality. Scope: local bookworm: resolved (fixed in 2.10

CVE-2023-5764 [HIGH] CVE-2023-5764: ansible - A template injection flaw was found in Ansible where a user's controller interna... A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data. Scope: local bookworm: resolved (fixed in 5.4.0-1) bullseye: resolved (fixed in

CVE-2023-4237 [HIGH] CVE-2023-4237: ansible - A flaw was found in the Ansible Automation Platform. When creating a new keypair... A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability. Scope: local bookworm: resolved (fixed in 7.7.0+dfsg-3+deb12u1) bull

CVE-2018-10875 [HIGH] CVE-2018-10875: ansible - A flaw was found in ansible. ansible.cfg is read from the current working direct... A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code. Scope: local bookworm: resolved (fixed in 2.6.1+dfsg-1) bullseye: resolved (fixed in 2.6.1+dfsg-1) forky: resolved (fixed in 2.6.

CVE-2018-10874 [HIGH] CVE-2018-10874: ansible - In ansible it was found that inventory variables are loaded from current working... In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result. Scope: local bookworm: resolved (fixed in 2.6.1+dfsg-1) bullseye: resolved (fixed in 2.6.1+dfsg-1) forky: resolved (fixed in 2.6.1+dfsg-1) sid: resolved (fixed in 2.6.1+

CVE-2020-1737 [HIGH] CVE-2020-1737: ansible - A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and pri... A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed

CVE-2019-14904 [HIGH] CVE-2019-14904: ansible - A flaw was found in the solaris_zone module from the Ansible Community modules. ... A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. An

CVE-2019-14846 [HIGH] CVE-2019-14846: ansible - In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engi... In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process. Scope: local bookworm