CVE-2019-14905: Command Injection
A vulnerability has been found in nxosfilecopy from Ansible module. Filenames are used to perform actions to copy files to a flash or bootflash on NXOS devices. However, nxosfilecopy takes remotefile parameter which is used for destination. Malicious code could crafts the filename parameter to take advantage by performing an OS command injection.
Other sources
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxosfilecopy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID of this Ansible Engine vulnerability?
The vulnerability ID is CVE-2019-14905.
What is the severity rating of CVE-2019-14905?
The severity rating of CVE-2019-14905 is high (5.6).
Which versions of Ansible Engine are affected by CVE-2019-14905?
The affected versions are 2.9.x before 2.9.3, 2.8.x before 2.8.8, and 2.7.x before 2.7.16.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by crafting a malicious filename parameter to perform arbitrary commands on NXOS devices.
How can I fix CVE-2019-14905?
To fix CVE-2019-14905, upgrade to Ansible Engine version 2.9.4, 2.8.8, or 2.7.16.