Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
References
Configurations
History
21 Nov 2024, 03:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://rhn.redhat.com/errata/RHSA-2017-0195.html - Third Party Advisory | |
| References | () http://rhn.redhat.com/errata/RHSA-2017-0260.html - Third Party Advisory | |
| References | () http://www.securityfocus.com/bid/95352 - Third Party Advisory, VDB Entry | |
| References | () https://access.redhat.com/errata/RHSA-2017:0448 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2017:0515 - Third Party Advisory | |
| References | () https://access.redhat.com/errata/RHSA-2017:1685 - Third Party Advisory | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9587 - Issue Tracking, Third Party Advisory | |
| References | () https://security.gentoo.org/glsa/201701-77 - Third Party Advisory | |
| References | () https://www.exploit-db.com/exploits/41013/ - Exploit, Third Party Advisory, VDB Entry |
Information
Published : 2018-04-24 16:29
Updated : 2024-11-21 03:01
NVD link : CVE-2016-9587
Mitre link : CVE-2016-9587
CVE.ORG link : CVE-2016-9587
JSON object : View
Products Affected
redhat
- ansible
- openstack
ansible
- ansible
CWE
CWE-20
Improper Input Validation