CVE-2016-8628: Command Injection
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
Other sources
It was found that it's possible to inject code and gain remote code execution via setting ansiblesshexecutable variable by attacker that takes over of controlled server.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-8628?
CVE-2016-8628 is considered a critical vulnerability due to its ability to allow arbitrary command execution on Ansible clients.
How do I fix CVE-2016-8628?
To fix CVE-2016-8628, upgrade Ansible to version 2.2.0 or later.
What versions of Ansible are affected by CVE-2016-8628?
CVE-2016-8628 affects all versions of Ansible prior to 2.2.0.
Can CVE-2016-8628 be exploited remotely?
Yes, CVE-2016-8628 can be exploited remotely by attackers with access to the Ansible controller.
What are the implications of CVE-2016-8628 for system security?
The implications of CVE-2016-8628 include potential unauthorized access and control over Ansible-managed systems.