OS Command Injection in Ansible - CVE-2019-14905
Published: December 8, 2019 / Updated: January 24, 2020
Vulnerability identifier: #VU23450
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-14905
CWE-ID: CWE-78
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to execute arbitrary shell commands on the target system.
The vulnerability exists due to incorrect validation of filenames within the nxos_file_copy module when copying files to a flash or bootflash on NXOS devices using the remote_file parameter. A local user or malicious code can abuse this functionality to inject and execute arbitrary OS commands on the system with elevated privileges.
Affected software
Ansible
ansible (Alpine package)
ansible
Fedora
SUSE Linux
Opensuse
ansible (Alpine package)
ansible
Fedora
SUSE Linux
Opensuse
How to mitigate CVE-2019-14905
Install updates from vendor's website.
Ansible - update to 2.9.2
ansible (Alpine package) - addressed in versions 2.7.16-r0, 2.8.8-r0
ansible - addressed in versions 2.9.3-1.el7, 2.9.3-1.el8, 2.9.3-1.fc30, 2.9.3-1.fc31
ansible (Alpine package) - addressed in versions 2.7.16-r0, 2.8.8-r0
ansible - addressed in versions 2.9.3-1.el7, 2.9.3-1.el8, 2.9.3-1.fc30, 2.9.3-1.fc31