CVE-2018-10875: High severity redhat Ansible Engine vulnerability
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
Other sources
It was found that ansible.cfg is being read from current working directory, which cam be made to point to plugin or module paths that are under control of the attacker, allowing to execute arbitrary code.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
CVE-2018-10875
What is the severity of CVE-2018-10875?
The severity of CVE-2018-10875 is high (CVSS score of 7.8).
How does CVE-2018-10875 impact Ansible?
CVE-2018-10875 allows an attacker to execute arbitrary code by altering the ansible.cfg file and making it point to a plugin or module path under their control.
Which versions of Ansible are affected by CVE-2018-10875?
Ansible versions 2.5.1+dfsg-1ubuntu0.1 and earlier, as well as 2.6.1+dfsg-1 and earlier, are affected by CVE-2018-10875.
How can I fix CVE-2018-10875 in Ansible?
To fix CVE-2018-10875 in Ansible, upgrade to version 2.5.1+dfsg-1ubuntu0.1 or later for Ubuntu, or version 2.6.1+dfsg-1 or later for all other distributions.