CVE-2013-2233: High severity red hat ansible vulnerability
A security flaw was found in the way Ansible, a SSH-based configuration management, deployment, and task execution system, performed remote server's SSH host key management (previously ability to store known SSH server's host keys to local cache was not supported). A remote attacker could use this flaw to conduct man-in-the-middle (MiTM) attacks against the Ansible task execution system user.
References: [1] http://www.openwall.com/lists/oss-security/2013/07/01/2 [2] http://www.openwall.com/lists/oss-security/2013/07/02/6
Upstream bug (no upstream patch as of 2013-07-03): [3] https://github.com/ansible/ansible/issues/857
Other sources
Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2013-2233?
CVE-2013-2233 is a vulnerability in Ansible that makes it easier for remote attackers to conduct man-in-the-middle attacks.
How does CVE-2013-2233 affect Ansible?
CVE-2013-2233 affects Ansible before version 1.2.1.
What is the severity of CVE-2013-2233?
The severity of CVE-2013-2233 is high with a CVSS score of 7.4.
How can remote attackers exploit CVE-2013-2233?
Remote attackers can exploit CVE-2013-2233 by leveraging a failure to cache SSH host keys, allowing them to conduct man-in-the-middle attacks.
Are there any references for CVE-2013-2233?
Yes, there are references available for CVE-2013-2233. You can find them at the following links: [link1](http://www.openwall.com/lists/oss-security/2013/07/01/2), [link2](http://www.openwall.com/lists/oss-security/2013/07/02/6), [link3](https://bugzilla.redhat.com/show_bug.cgi?id=980821).