CVE-2016-9587: Input Validation
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
Other sources
Ansible before versions 2.1.4.0, 2.2.1.0 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
— GitHub
It is reported that a compromised remote hosts can lead to running commands on the Ansible controller.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-9587?
CVE-2016-9587 is considered to have a moderate severity level due to improper input validation in Ansible.
How do I fix CVE-2016-9587?
To fix CVE-2016-9587, update Ansible to versions 2.1.4 or 2.2.1 or later.
Who is affected by CVE-2016-9587?
CVE-2016-9587 affects users of Ansible versions earlier than 2.1.4 and 2.2.1.
What type of vulnerability is CVE-2016-9587?
CVE-2016-9587 is a vulnerability related to improper input validation.
Can CVE-2016-9587 be exploited remotely?
Yes, CVE-2016-9587 can be exploited by an attacker with control over a client system sending data to the Ansible server.