What is CVE-2018-10875?

CVE-2018-10875 is a high-severity vulnerability in [Unknown] Ansible, classified under Untrusted Search Path. CVSS score: 7.8/10. Published 2018-07-13.

How severe is CVE-2018-10875?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in [Unknown] Ansible

CVE-2018-10875

A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.

EPSS: 0.006 (43.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

[Unknown] Ansible — versions n/a
Canonical Ubuntu_linux — versions 16.04, 18.04, 19.04
Debian Debian_linux — versions 9.0, 8.0
Redhat Ansible_engine — versions 2.0, 2.4, 2.5
Redhat Ceph_storage — versions 2.0, 3.0
Redhat Gluster_storage — versions 3.0.0
Redhat Openshift — versions 3.0
Redhat Openstack — versions 10, 12, 13
Redhat Virtualization — versions 4.0
Redhat Virtualization_host — versions 4.0

Weakness classification (CWE)

CWE-426 — Untrusted Search Path

References

secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_SECTRACK)
secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Issue Tracking)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2018-10875?: CVE-2018-10875 is a high-severity vulnerability in [Unknown] Ansible, classified under Untrusted Search Path. CVSS score: 7.8/10. Published 2018-07-13.
How severe is CVE-2018-10875?: High severity. CVSS v3 base score is 7.8 out of 10.