CVE-2019-14904: Input Validation
A flaw was found in the solariszone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.
Other sources
Vulnerability in solariszone from Ansible modules accepts the zone name to perform actions related to zones. However, while running these actions on the system, solariszone module check the status of the zone by executing a os.system() call and using the zone name as a parameter. A malicious user could provide a crafted zone name which allows executing commands into the server manipulating the module behaviour.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ansible-engineto a version that resolves this vulnerability.Fixed in 2.9.4 - Upgrade
Upgrade
redhat/ansible-engineto a version that resolves this vulnerability.Fixed in 2.8.8 - Upgrade
Upgrade
redhat/ansible-engineto a version that resolves this vulnerability.Fixed in 2.7.16 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.9.3 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.8.8 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.7.16 - Upgrade
Upgrade
debian/ansibleto a version that resolves this vulnerability.Fixed in 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1Fixed in 2.10.7+merged+base+2.10.17+dfsg-0+deb11u2Fixed in 7.7.0+dfsg-3+deb12u1Fixed in 11.2.0+dfsg-1 - Upgrade
Upgrade
alpine/ansibleto a version that resolves this vulnerability.Fixed in 2.8.8-r0 - Upgrade
Upgrade
alpine/ansibleto a version that resolves this vulnerability.Fixed in 2.9.3-r0 - Upgrade
Upgrade
alpine/ansibleto a version that resolves this vulnerability.Fixed in 2.7.16-r0 - Upgrade
Upgrade
alpine/ansible-baseto a version that resolves this vulnerability.Fixed in 2.9.3-r0
Event History
Frequently Asked Questions
What is CVE-2019-14904?
CVE-2019-14904 is a vulnerability found in the solaris_zone module from the Ansible Community modules.
What is the severity of CVE-2019-14904?
The severity of CVE-2019-14904 is medium (4 out of 10).
How does CVE-2019-14904 affect the software?
CVE-2019-14904 affects Ansible versions 2.7.7+dfsg-1+deb10u1, 2.7.16, 2.8.8, 2.9.4, 2.10.7+merged+base+2.10.8+dfsg-1, 7.3.0+dfsg-1, 7.7.0+dfsg-2.
What is the remedy for CVE-2019-14904?
The remedy for CVE-2019-14904 is to update to Ansible version 2.9.4, 2.8.8, 2.7.16, 2.7.7+dfsg-1+deb10u1, 2.10.7+merged+base+2.10.8+dfsg-1, 7.3.0+dfsg-1, or 7.7.0+dfsg-2.
Where can I find more information about CVE-2019-14904?
You can find more information about CVE-2019-14904 in the following references: [Reference 1](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1777690), [Reference 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1777689), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1777688).