Fedora EPEL 6 update for ansible



| Updated: 2025-04-24
Risk High
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2016-8628
CVE-2016-8614
CWE-ID CWE-77
CWE-320
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Fedora
Operating systems & Components / Operating system

ansible
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Command Injection

EUVDB-ID: #VU36808

Risk: High

CVSSv4.0: 2.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:U/U:Amber]

CVE-ID: CVE-2016-8628

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote privileged user to execute arbitrary code.

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 6.0

ansible: before 2.2.0.0-2.el6

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-775a03185e


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Key management errors

EUVDB-ID: #VU36806

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-8614

CWE-ID: CWE-320 - Key Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 6.0

ansible: before 2.2.0.0-2.el6

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2016-775a03185e


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###