Published: 12/08/2015 Updated: 16/09/2019

CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6

VMScore: 383

Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

Ansible prior to 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle malicious users to spoof SSL servers via an arbitrary valid certificate.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat ansible

Ansible before 192 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate ...

Ansible Changes By Release 21 TBD - ACTIVE DEVELOPMENT ####New Modules: cloudstack: cs_volume ####New Filters: extract 201 "Over the Hills and Far Away" Fixes a major compatibility break in the synchronize module shipped with 200x That version of synchronize ran sudo on the controller prior to running rsync In 19x and previous, sudo was run on the hos

CWE-345 http://lists.opensuse.org/opensuse-updates/2015-07/msg00051.html http://www.openwall.com/lists/oss-security/2015/07/14/4 http://www.ansible.com/security http://lists.opensuse.org/opensuse-updates/2015-08/msg00029.html https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html https://nvd.nist.gov https://github.com/clhlc/ansible-2.0 https://access.redhat.com/security/cve/cve-2015-3908

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2015-3908

Vulnerability Summary

Vendor Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect