OS Command Injection in ansible-runner - CVE-2021-4041

Vulnerability identifier: #VU59579

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-4041

CWE-ID: CWE-78

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to improper input validation in the ansible_runner.interface.run_command. A local user can pass specially crafted parameters to the command that get executed on the host operating system instead of the guest OS.

ansible-runner
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
ansible-runner (Red Hat package)
Watson AI Gateway for Cloud Pak for Data

Install updates from vendor's website.

ansible-runner - update to 2.1.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.0
ansible-runner (Red Hat package) - update to 2.0.3-2.el8ap
Watson AI Gateway for Cloud Pak for Data - update to 4.5.3
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.0

• https://bugzilla.redhat.com/show_bug.cgi?id=2028074
• https://github.com/ansible/ansible-runner/commit/3533f265f4349a3f2a0283158cd01b59a6bbc7bd

• Privilege escalation in ansible-runner
• OS command injection in Red Hat Ansible Automation Platform
• Privilege escalation in IBM Watson Discovery for IBM Cloud Pak for Data
• OS command injection in IBM Watson AI Gateway for Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data