redhat ansible engine 2.7 vulnerabilities and exploits

(subscribe to this query)

5.2

CVSSv3

An archive traversal flaw was found in all ansible-engine versions 2.9.x before 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrit...

Redhat Ansible Engine Redhat Ansible Tower 3.0

3.9

CVSSv3

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2....

Redhat Cloudforms Management Engine 5.0 Redhat Ansible Tower Redhat Ansible Redhat Openstack 13

5

CVSSv3

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x prior to 2.7.17 and 2.8.x prior to 2.8.11 and 2.9.x prior to 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules a...

Redhat Ansible Tower Redhat Ansible Engine Debian Debian Linux 10.0

5.6

CVSSv3

A vulnerability was found in Ansible Engine versions 2.9.x prior to 2.9.3, 2.8.x prior to 2.8.8, 2.7.x prior to 2.7.16 and previous versions, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craf...

Redhat Ansible Engine Redhat Cloudforms Management Engine 5.0 Redhat Ceph Storage 3.0 Redhat Ansible Tower 3.0.0 Redhat Openstack 13 Fedoraproject Fedora 30 Opensuse Leap 15.1 Opensuse Backports Sle 15.0

3.3

CVSSv3

A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restricti...

Redhat Cloudforms Management Engine 5.0 Redhat Ansible Tower Redhat Ansible Redhat Openstack 13 Fedoraproject Fedora 31 Fedoraproject Fedora 32

5.5

CVSSv3

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an malicious user to access the logs or outputs of performed tasks to read keys used in playbooks from othe...

Redhat Ansible Engine Debian Debian Linux 10.0

5.5

CVSSv3

A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is t...

Redhat Ansible Engine Debian Debian Linux 10.0

5.5

CVSSv3

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions before 2.7.17, all Ansible 2.8.x versions before 2.8.11 and all Ansible 2.9.x versions before 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed...

Redhat Ansible Tower Redhat Ansible Engine Debian Debian Linux 10.0 Fedoraproject Fedora 30 Fedoraproject Fedora 31 Fedoraproject Fedora 32

4.6

CVSSv3

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Redhat Cloudforms Management Engine 5.0 Redhat Ansible Tower Redhat Openstack 13 Redhat Ansible Debian Debian Linux 10.0 Fedoraproject Fedora 30 Fedoraproject Fedora 31 Fedoraproject Fedora 32

5.5

CVSSv3

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x prior to 2.7.17 and 2.8.x prior to 2.8.11 and 2.9.x prior to 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as ass...

Redhat Ansible Tower Redhat Ansible Engine Redhat Ceph Storage 3.0 Redhat Openstack 10 Redhat Ceph Storage 2.0 Redhat Storage 3.0 Redhat Openstack 13 Redhat Openstack 15 Debian Debian Linux 10.0

Get Started

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook