Redhat Ansible
45 CVEs affecting Redhat Ansible. Latest disclosed: 2024-02-06. Critical: 5, High: 12.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-4657 | Critical | 9.8 | 2020-02-20 | The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted… |
CVE-2014-4678 | Critical | 9.8 | 2020-02-20 | The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted… |
CVE-2014-4967 | Critical | 9.8 | 2020-02-18 | Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed… |
CVE-2014-4966 | Critical | 9.8 | 2020-02-18 | Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows rem… |
CVE-2017-7550 | Critical | 9.8 | 2017-11-21 | A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could… |
CVE-2014-3498 | High | 8.8 | 2017-06-08 | The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands. |
CVE-2016-9587 | High | 8.1 | 2018-04-24 | Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with con… |
CVE-2017-7466 | High | 8.0 | 2018-06-22 | Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client syste… |
CVE-2020-10684 | High | 7.9 | 2020-03-24 | A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of… |
CVE-2015-6240 | High | 7.8 | 2017-06-07 | The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack. |
CVE-2016-3096 | High | 7.8 | 2016-06-03 | The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain… |
CVE-2016-8628 | High | 7.6 | 2018-07-31 | Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variabl… |
CVE-2022-3697 | High | 7.5 | 2022-10-28 | A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an a… |
CVE-2014-2686 | High | 7.5 | 2020-01-09 | Ansible prior to 1.5.4 mishandles the evaluation of some strings. |
CVE-2013-2233 | High | 7.4 | 2018-05-04 | Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys. |
CVE-2019-14904 | High | 7.3 | 2020-08-26 | A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checke… |
CVE-2023-5764 | High | 7.1 | 2023-12-12 | A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. T… |
CVE-2020-25636 | Medium | 6.6 | 2020-10-05 | A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to… |
CVE-2019-14864 | Medium | 6.5 | 2020-01-02 | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumolo… |
CVE-2019-14856 | Medium | 6.5 | 2019-11-26 | ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None |