Описание
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
It was found that ansible.cfg is being read from the current working directory, which can be made to point to plugin or module paths that are under control of the attacker. This could allow an attacker to execute arbitrary code.
Отчет
Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| CloudForms Management Engine 5 | ansible | Not affected | ||
| Red Hat Ceph Storage 2 | ansible | Affected | ||
| Red Hat Ceph Storage 3 | ansible | Affected | ||
| Red Hat OpenShift Enterprise 3 | ansible | Will not fix | ||
| Red Hat OpenStack Platform 14 (Rocky) | ansible | Not affected | ||
| Red Hat Satellite 6 | ansible | Not affected | ||
| Red Hat Storage 3 | ansible | Affected | ||
| Red Hat Ansible Engine 2.4 for RHEL 7 | ansible | Fixed | RHSA-2018:2152 | 10.07.2018 |
| Red Hat Ansible Engine 2.5 for RHEL 7 | ansible | Fixed | RHSA-2018:2150 | 10.07.2018 |
| Red Hat Ansible Engine 2.6 for RHEL 7 | ansible | Fixed | RHSA-2018:2166 | 10.07.2018 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.8 High
CVSS3
Связанные уязвимости
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
A flaw was found in ansible. ansible.cfg is read from the current work ...
Уязвимость системы управления конфигурациями Ansible, связанная с отсутствием контроля пути поиска конфигурационного файла ansible.cfg, позволяющая нарушителю выполнить произвольный код
EPSS
7.8 High
CVSS3