CVE-2019-14904: Input Validation
First published: Tue Nov 26 2019(Updated: )
A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Ansible | <2.7.15 | |
| Redhat Ansible | >=2.8.0<2.8.7 | |
| Redhat Ansible | >=2.9.0<2.9.2 | |
| Debian Debian Linux | =9.0 | |
| Debian Debian Linux | =10.0 | |
| debian/ansible | 2.7.7+dfsg-1+deb10u1 2.7.7+dfsg-1+deb10u2 2.10.7+merged+base+2.10.8+dfsg-1 7.3.0+dfsg-1 7.7.0+dfsg-3 | |
| redhat/ansible-engine | <2.9.4 | 2.9.4 |
| redhat/ansible-engine | <2.8.8 | 2.8.8 |
| redhat/ansible-engine | <2.7.16 | 2.7.16 |
| pip/ansible | >=2.9.0a1<2.9.3 | 2.9.3 |
| pip/ansible | >=2.8.0a1<2.8.8 | 2.8.8 |
| pip/ansible | >=0<2.7.16 | 2.7.16 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1776944
- https://github.com/ansible/ansible/pull/65686
- https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html
- https://www.debian.org/security/2021/dsa-4950
- https://github.com/ansible/ansible/blob/stable-2.0/CHANGELOG.md
- https://security-tracker.debian.org/tracker/CVE-2019-14904
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1777690
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1777689
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1777688
- https://access.redhat.com/errata/RHSA-2020:0217
- https://access.redhat.com/errata/RHSA-2020:0215
- https://access.redhat.com/errata/RHSA-2020:0216
- https://access.redhat.com/errata/RHSA-2020:0218
- https://access.redhat.com/security/cve/cve-2019-14904
- https://nvd.nist.gov/vuln/detail/CVE-2019-14904
- https://github.com/ansible/ansible/commit/589a415f887b6f2bb65cd07fe6b2e9d0a8156b69
- https://github.com/ansible/ansible/commit/6a86650109b8654f5898369e45d3857624edf907
- https://github.com/ansible/ansible/commit/a1b0f72c98b4b2afaab8aafa255e82c2075049c8
- https://github.com/advisories/GHSA-gwr8-5j83-483c (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-161.yaml
Frequently Asked Questions
What is CVE-2019-14904?
CVE-2019-14904 is a vulnerability found in the solaris_zone module from the Ansible Community modules.
What is the severity of CVE-2019-14904?
The severity of CVE-2019-14904 is medium (4 out of 10).
How does CVE-2019-14904 affect the software?
CVE-2019-14904 affects Ansible versions 2.7.7+dfsg-1+deb10u1, 2.7.16, 2.8.8, 2.9.4, 2.10.7+merged+base+2.10.8+dfsg-1, 7.3.0+dfsg-1, 7.7.0+dfsg-2.
What is the remedy for CVE-2019-14904?
The remedy for CVE-2019-14904 is to update to Ansible version 2.9.4, 2.8.8, 2.7.16, 2.7.7+dfsg-1+deb10u1, 2.10.7+merged+base+2.10.8+dfsg-1, 7.3.0+dfsg-1, or 7.7.0+dfsg-2.
Where can I find more information about CVE-2019-14904?
You can find more information about CVE-2019-14904 in the following references: [Reference 1](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1777690), [Reference 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1777689), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1777688).
- collector/nvd-index
- collector/security-tracker-debian
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/remedy
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-14904
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-gwr8-5j83-483c
- agent/severity
- agent/references
- agent/last-modified-date
- agent/event
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- agent/author
- agent/tags
- collector/github-advisory
- vendor/redhat
- canonical/redhat ansible
- version/redhat ansible/2.8.0
- version/redhat ansible/2.9.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/9.0
- version/debian debian linux/10.0
- package-manager/debian
- package-manager/redhat
- package-manager/pip