redhat ansible runner vulnerabilities and exploits

(subscribe to this query)

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host...

Redhat Ansible Runner Redhat Ansible Runner 2.1.0

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use...

Redhat Ansible Runner 2.0.0

A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an malicious user to pre-create the directory, resulting in reading private information or forcing ansible-runner to write file...

Redhat Ansible Runner 2.0.0

A flaw was found in ansible-tower where the default installation is vulnerable to job isolation escape. This flaw allows an malicious user to elevate the privilege from a low privileged user to an AWX user from outside the isolated environment.

Redhat Ansible Tower 3.0 Redhat Ansible Automation Platform Early Access 2.0 Redhat Ansible Automation Platform Text-only Advisories -Redhat Ansible Automation Platform 2.0 Redhat Ansible Automation Platform 2.1

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x prior to 2.8.15 and ansible-engine 2.9.x prior to 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the defaul...

Redhat Ansible Engine Redhat Ansible Tower 3.0 Redhat Ansible Tower Redhat Ceph Storage 2.0 Redhat Ceph Storage 3.0 Redhat Openstack Platform 10.0 Redhat Openstack Platform 13.0 Debian Debian Linux 10.0

runner/connection_plugins/ssh.py in Ansible prior to 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.

In all versions of cpio prior to 2.13 does not properly validate input files when generating TAR archives. When cpio is used to create TAR archives from paths an attacker can write to, the resulting archive may contain files with permissions the attacker did not have or in paths ...

Gnu Cpio Redhat Enterprise Linux 7.0 Redhat Enterprise Linux 8.0

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 up to and including 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.

A flaw exists in ibus in versions prior to 1.5.22 that allows any unprivileged user to monitor and send method calls to the ibus bus of another user due to a misconfiguration in the DBus server setup. A local attacker may use this flaw to intercept all keystrokes of a victim user...

Ibus Project Ibus Redhat Enterprise Linux 7.0 Redhat Enterprise Linux 8.0 Canonical Ubuntu Linux 18.04 Canonical Ubuntu Linux 19.10 Canonical Ubuntu Linux 16.04 Oracle Zfs Storage Appliance Kit 8.8

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook