SB2016110505 - Fedora 24 update for ansible

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016110505

SB2016110505 - Fedora 24 update for ansible

Published: November 5, 2016 Updated: April 24, 2025

Security Bulletin ID SB2016110505
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Key management errors (CVE-ID: CVE-2016-8614)

The vulnerability allows a remote non-authenticated attacker to manipulate data.

A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.


2) Command Injection (CVE-ID: CVE-2016-8628)

The vulnerability allows a remote privileged user to execute arbitrary code.

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.


Remediation

Install update from vendor's website.

References