PYSEC-2015-1: Ansible Ansible vulnerability

Q: Which deployments are exposed to this issue?

Ansible versions before 1.9.2 are affected when they establish SSL connections and rely on certificate validation to verify the identity of the server.

Q: What does an attacker need to exploit it?

An attacker needs a man-in-the-middle position on the SSL connection and an arbitrary valid X.509 certificate. Because the hostname is not checked against the certificate CN or subjectAltName, the certificate does not need to identify the intended server.

Q: What is the remediation?

Upgrade Ansible to version 1.9.2 or later.

Published Aug 12, 2015

Updated

Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Affected Software

1 affected component

Ansible Ansible<1.9.2

Event History

Aug 12, 2015

CVE Published

via OSV·02:59 PM

Data Sourced

via OSV·02:59 PM

Description

Frequently Asked Questions

Which deployments are exposed to this issue?

Ansible versions before 1.9.2 are affected when they establish SSL connections and rely on certificate validation to verify the identity of the server.

What does an attacker need to exploit it?

An attacker needs a man-in-the-middle position on the SSL connection and an arbitrary valid X.509 certificate. Because the hostname is not checked against the certificate CN or subjectAltName, the certificate does not need to identify the intended server.

What is the remediation?

Upgrade Ansible to version 1.9.2 or later.

PYSEC-2015-1: Ansible Ansible vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What is the remediation?