Arbitrary Code Execution

2018-07-1607:43:28

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

33.7%

JSON

ansible is vulnerable to arbitrary code execution attacks. The application does not restrict the ansible.cfg file from being installed into a world readable directory, allowing a malicious user to use it to direct to a malicious plugin or module to execute arbitrary code.

CPENameOperatorVersion
ansiblele2.6.0
ansiblele2.4.5.0
ansiblele2.5.5
ansibleeq1.9.4__1.el7aos
ansibleeq2.4.0.0__1.el7ae
ansibleeq2.2.0__0.50.prerelease.el7
ansibleeq2.4.1.0__1.el7
ansibleeq2.5.4__1.el7ae
ansibleeq2.3.1.0__1.el7
ansibleeq1.9.3__2.el7aos

Name	Operator	Version
ansible	le	2.6.0
ansible	le	2.4.5.0
ansible	le	2.5.5
ansible	eq	1.9.4__1.el7aos
ansible	eq	2.4.0.0__1.el7ae
ansible	eq	2.2.0__0.50.prerelease.el7
ansible	eq	2.4.1.0__1.el7
ansible	eq	2.5.4__1.el7ae
ansible	eq	2.3.1.0__1.el7
ansible	eq	1.9.3__2.el7aos