SB2016111507 - OpenShift Container Platform 3 update for openshift-ansible and ansible
Published: November 15, 2016 Updated: April 24, 2025
Security Bulletin ID
SB2016111507
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Command Injection (CVE-ID: CVE-2016-8628)
The vulnerability allows a remote privileged user to execute arbitrary code.
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
Remediation
Install update from vendor's website.