CVE-2019-14904: Input Validation
A flaw was found in the solariszone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.
Other sources
Vulnerability in solariszone from Ansible modules accepts the zone name to perform actions related to zones. However, while running these actions on the system, solariszone module check the status of the zone by executing a os.system() call and using the zone name as a parameter. A malicious user could provide a crafted zone name which allows executing commands into the server manipulating the module behaviour.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2019-14904?
CVE-2019-14904 is a vulnerability found in the solaris_zone module from the Ansible Community modules.
What is the severity of CVE-2019-14904?
The severity of CVE-2019-14904 is medium (4 out of 10).
How does CVE-2019-14904 affect the software?
CVE-2019-14904 affects Ansible versions 2.7.7+dfsg-1+deb10u1, 2.7.16, 2.8.8, 2.9.4, 2.10.7+merged+base+2.10.8+dfsg-1, 7.3.0+dfsg-1, 7.7.0+dfsg-2.
What is the remedy for CVE-2019-14904?
The remedy for CVE-2019-14904 is to update to Ansible version 2.9.4, 2.8.8, 2.7.16, 2.7.7+dfsg-1+deb10u1, 2.10.7+merged+base+2.10.8+dfsg-1, 7.3.0+dfsg-1, or 7.7.0+dfsg-2.
Where can I find more information about CVE-2019-14904?
You can find more information about CVE-2019-14904 in the following references: [Reference 1](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1777690), [Reference 2](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1777689), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1777688).