Red Hat Vulnerabilities and Affected Products
Vulnerabilities associated with Ansible.
Products
Clear product- Red Hat Enterprise Linux 91,515 vulnerabilities
- Red Hat Enterprise Linux 81,496 vulnerabilities
- Red Hat Enterprise Linux 71,145 vulnerabilities
- Red Hat Enterprise Linux 101,132 vulnerabilities
- Red Hat Enterprise Linux 61,113 vulnerabilities
- Red Hat OpenShift Container Platform 4430 vulnerabilities
- Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support402 vulnerabilities
- Red Hat Enterprise Linux 9.6 Extended Update Support386 vulnerabilities
- Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support377 vulnerabilities
- Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions367 vulnerabilities
- Red Hat Enterprise Linux 10.0 Extended Update Support361 vulnerabilities
- Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions356 vulnerabilities
- Red Hat Enterprise Linux 8.8 Telecommunications Update Service353 vulnerabilities
- Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On325 vulnerabilities
- Red Hat Enterprise Linux 7 Extended Lifecycle Support319 vulnerabilities
- Red Hat OpenShift AI (RHOAI)302 vulnerabilities
- Red Hat Enterprise Linux 9.4 Extended Update Support297 vulnerabilities
- Red Hat Hardened Images277 vulnerabilities
- Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions270 vulnerabilities
- Red Hat Enterprise Linux 8.6 Telecommunications Update Service253 vulnerabilities
- Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions253 vulnerabilities
- Red Hat JBoss Enterprise Application Platform Expansion Pack236 vulnerabilities
- Red Hat Enterprise Linux 8.2 Advanced Update Support213 vulnerabilities
- Red Hat Single Sign-On 7177 vulnerabilities
- Red Hat Fuse 7175 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
Insertion of Sensitive Information into Log File and Improper Output Neutralization for Logs in ansibleA flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality. | CVSS-v4.0 | EPSS0.41% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Improper Output Neutralization and Improper Encoding or Escaping of Output for Logs in ansibleAn Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality. | CVSS-v4.0 | EPSS0.573% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Exposure of Resource to Wrong Sphere and Insecure Temporary File in AnsibleAn incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected. | CVSS-v4.0 | EPSS0.255% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Exposure of Sensitive Information to an Unauthorized Actor in ansibleA flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality. CWE-200May 12, 2020 | CVSS-v4.0 | EPSS0.409% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Exposure of Resource to Wrong Sphere and Insecure Temporary File in AnsibleA flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory i… | CVSS-v4.0 | EPSS0.379% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Path Traversal in AnsibleAn archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system. CWE-22Apr 30, 2020 | CVSS-v4.0 | EPSS0.361% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in AnsibleA vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues. | CVSS-v4.0 | EPSS0.742% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Code Injection, Race Condition, and Execution with Unnecessary Privileges in AnsibleA flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection. | CVSS-v4.0 | EPSS0.347% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Argument Injection in AnsibleA flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. CWE-88Mar 16, 2020 | CVSS-v4.0 | EPSS0.384% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in AnsibleA flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to … | CVSS-v4.0 | EPSS0.377% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Path Traversal in AnsibleA flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. CWE-22Mar 16, 2020 | CVSS-v4.0 | EPSS0.492% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Incorrect Permission Assignment for Critical Resource in AnsibleA flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. CWE-732Mar 16, 2020 | CVSS-v4.0 | EPSS0.405% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and Exposure of Sensitive Information to an Unauthorized Actor in AnsibleA security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have a… | CVSS-v4.0 | EPSS0.51% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Exposure of Sensitive Information to an Unauthorized Actor in AnsibleA flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs. CWE-200Mar 12, 2020 | CVSS-v4.0 | EPSS0.361% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Ansible vulnerable to Exposure of Resource to Wrong Sphere and Insecure Temporary FileA race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target direct… | CVSS-v4.0 | EPSS0.403% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Path Traversal in AnsibleA flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10. CWE-22Mar 9, 2020 | CVSS-v4.0 | EPSS0.365% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
OS Command Injection in ansibleA flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts. CWE-78Mar 3, 2020 | CVSS-v4.0 | EPSS0.448% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
CVE-2019-14864MEDIUM | Inclusion of Sensitive Information in Log Files and Improper Output Neutralization for Logs in AnsibleAnsible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used send tasks results events to collectors. This would discloses and collects any sensitive data. | CVSS6.5v3.1 | EPSS1.87% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
Exposure of Sensitive Information to an Unauthorized Actor in ansibleA flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks. CWE-200Nov 25, 2019 | CVSS-v4.0 | EPSS1.87% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Ansible password prompts could expose passwordsansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them. | CVSS-v4.0 | EPSS1.52% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Ansible leaks sensitive information to logs when told not toA vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub parameters marked as no_log, passing an invalid parameter name to the module will cause the task to fail before the no_log options in the sub parameters are processed. As a result, data in the sub parameter fields will not be masked and will be displayed if Ansible is run with increased verbosity and present in the module invocation arguments for the task. | CVSS-v4.0 | EPSS0.424% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Ansible Uses Plugins That Disclose CredentialsIn Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process. | CVSS-v4.0 | EPSS0.513% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Exposure of Sensitive Information to an Unauthorized Actor in ansibleA flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed. CWE-200Jul 30, 2019 | CVSS-v4.0 | EPSS1.77% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Ansible Path Traversal vulnerabilityAnsible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path. CWE-22Mar 27, 2019 | CVSS-v4.0 | EPSS0.526% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
Ansible sensitive information disclosureansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data. CWE-200Jan 3, 2019 | CVSS-v4.0 | EPSS2.48% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |