Red Hat Ansible
58 CVEs affecting Red Hat Ansible. Latest disclosed: 2024-02-06. Critical: 5, High: 15.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2014-4657 | Critical | 9.8 | 2020-02-20 | The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted… |
CVE-2014-4678 | Critical | 9.8 | 2020-02-20 | The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted… |
CVE-2014-4967 | Critical | 9.8 | 2020-02-18 | Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed… |
CVE-2014-4966 | Critical | 9.8 | 2020-02-18 | Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows rem… |
CVE-2017-7550 | Critical | 9.8 | 2017-11-21 | A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could… |
CVE-2017-7550 | Critical | 9.8 | 2017-11-21 | A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could… |
CVE-2014-3498 | High | 8.8 | 2017-06-08 | The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands. |
CVE-2016-9587 | High | 8.1 | 2018-04-24 | Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with con… |
CVE-2017-7466 | High | 8.0 | 2018-06-22 | Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client syste… |
CVE-2020-10684 | High | 7.9 | 2020-03-24 | A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of… |
CVE-2020-10684 | High | 7.9 | 2020-03-24 | A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of… |
CVE-2019-14846 | High | 7.8 | 2019-10-08 | In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to… |
CVE-2015-6240 | High | 7.8 | 2017-06-07 | The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack. |
CVE-2016-3096 | High | 7.8 | 2016-06-03 | The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain… |
CVE-2016-8628 | High | 7.6 | 2018-07-31 | Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variabl… |
CVE-2016-8628 | High | 7.6 | 2018-07-31 | Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variabl… |
CVE-2022-3697 | High | 7.5 | 2022-10-28 | A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an a… |
CVE-2020-1737 | High | 7.5 | 2020-03-09 | A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extract… |
CVE-2014-2686 | High | 7.5 | 2020-01-09 | Ansible prior to 1.5.4 mishandles the evaluation of some strings. |
CVE-2020-1734 | High | 7.4 | 2020-03-03 | A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by o… |