What is the severity of CVE-2015-6240?

CVE-2015-6240 is classified as a medium severity vulnerability, allowing local users to escape restricted environments.

How do I fix CVE-2015-6240?

To fix CVE-2015-6240, upgrade to Ansible version 1.9.2 or later.

Who is affected by CVE-2015-6240?

Local users operating on Ansible versions prior to 1.9.2 and Red Hat Ansible versions up to 1.9.1 are affected by CVE-2015-6240.

What types of attacks does CVE-2015-6240 allow?

CVE-2015-6240 allows attackers to perform symlink attacks leading to unauthorized access outside the restricted environment.

Is CVE-2015-6240 related to specific Ansible plugins?

Yes, CVE-2015-6240 affects the chroot, jail, and zone connection plugins in Ansible.

Vulnerability/
CVE-2015-6240

high

7.8

CWE

7/6/2017

13/5/2022

30/8/2024

CVE-2015-6240

First published: Wed Jun 07 2017(Updated: )

The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.

Credit: cve@mitre.org cve@mitre.org

Affected Software	Affected Version	How to fix
pip/ansible	<1.9.2	1.9.2
Redhat Ansible	<=1.9.1

Remedy

https://github.com/ansible/ansible/commit/952166f48eb0f5797b75b160fd156bbe1e8fc647

Remedy

https://github.com/ansible/ansible/commit/ca2f2c4ebd7b5e097eab0a710f79c1f63badf95b

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2015-6240?
CVE-2015-6240 is classified as a medium severity vulnerability, allowing local users to escape restricted environments.
How do I fix CVE-2015-6240?
To fix CVE-2015-6240, upgrade to Ansible version 1.9.2 or later.
Who is affected by CVE-2015-6240?
Local users operating on Ansible versions prior to 1.9.2 and Red Hat Ansible versions up to 1.9.1 are affected by CVE-2015-6240.
What types of attacks does CVE-2015-6240 allow?
CVE-2015-6240 allows attackers to perform symlink attacks leading to unauthorized access outside the restricted environment.
Is CVE-2015-6240 related to specific Ansible plugins?
Yes, CVE-2015-6240 affects the chroot, jail, and zone connection plugins in Ansible.

collector/nvd-index
agent/author
agent/remedy
agent/softwarecombine
agent/type
collector/mitre-cve
source/MITRE
agent/weakness
agent/severity
agent/description
agent/first-publish-date
agent/event
collector/github-advisory-latest
source/GitHub
alias/GHSA-wwwh-47wp-m522
alias/CVE-2015-6240
agent/software-canonical-lookup
agent/last-modified-date
agent/references
collector/nvd-cve
source/NVD
collector/github-advisory
agent/trending
agent/tags
agent/source
vendor/redhat
canonical/redhat ansible
version/redhat ansible/1.9.1
package-manager/pip

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.

Frequently Asked Questions

What is the severity of CVE-2015-6240?
CVE-2015-6240 is classified as a medium severity vulnerability, allowing local users to escape restricted environments.
How do I fix CVE-2015-6240?
To fix CVE-2015-6240, upgrade to Ansible version 1.9.2 or later.
Who is affected by CVE-2015-6240?
Local users operating on Ansible versions prior to 1.9.2 and Red Hat Ansible versions up to 1.9.1 are affected by CVE-2015-6240.
What types of attacks does CVE-2015-6240 allow?
CVE-2015-6240 allows attackers to perform symlink attacks leading to unauthorized access outside the restricted environment.
Is CVE-2015-6240 related to specific Ansible plugins?
Yes, CVE-2015-6240 affects the chroot, jail, and zone connection plugins in Ansible.