Multiple vulnerabilities in Ansible



Published: 2018-07-31 | Updated: 2020-08-08
Risk High
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2016-8614
CVE-2016-8628
CWE-ID CWE-320
CWE-77
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		Ansible
Server applications / Remote management servers, RDP, SSH

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Key management errors

EUVDB-ID: #VU36806

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-8614

CWE-ID: CWE-320 - Key Management Errors

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Ansible: 2.0.0 - 2.1.6.0-1

External links

http://www.securityfocus.com/bid/94108
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8614
http://github.com/ansible/ansible-modules-core/issues/5237
http://github.com/ansible/ansible-modules-core/pull/5353
http://github.com/ansible/ansible-modules-core/pull/5357


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Command Injection

EUVDB-ID: #VU36808

Risk: High

CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-8628

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote privileged user to execute arbitrary code.

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Ansible: 2.0.0 - 2.1.6.0-1

External links

http://www.securityfocus.com/bid/94109
http://access.redhat.com/errata/RHSA-2016:2778
http://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8628


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###