PYSEC-2018-39: Input Validation

Q: Which systems are realistically exposed to this issue?

Ansible servers are exposed if they manage a client system that an attacker controls and that client can send facts back to the server. Exploitation results in code execution on the Ansible server with that server's privileges.

Q: What does an attacker need to exploit it?

The attacker must control a client system managed by Ansible and be able to return facts to the Ansible server. No attacker privileges or user interaction are indicated by the supplied vector, but exploitation has high attack complexity.

Q: Which Ansible versions are affected?

The issue affects Ansible versions before 2.1.4 and before 2.2.1. The provided data does not identify affected release branches beyond those version thresholds.

Published Apr 24, 2018

Updated

Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

Affected Software

1 affected component

Ansible Ansible<2.1.4, <2.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ansible to a version that resolves this vulnerability.
Fixed in 2.1.4
Upgrade
Upgrade Ansible to a version that resolves this vulnerability.
Fixed in 2.2.1

Event History

Apr 24, 2018

CVE Published

via OSV·04:29 PM

Data Sourced

via OSV·04:29 PM

DescriptionSeverity

Frequently Asked Questions

Which systems are realistically exposed to this issue?

Ansible servers are exposed if they manage a client system that an attacker controls and that client can send facts back to the server. Exploitation results in code execution on the Ansible server with that server's privileges.

What does an attacker need to exploit it?

The attacker must control a client system managed by Ansible and be able to return facts to the Ansible server. No attacker privileges or user interaction are indicated by the supplied vector, but exploitation has high attack complexity.

Which Ansible versions are affected?

The issue affects Ansible versions before 2.1.4 and before 2.2.1. The provided data does not identify affected release branches beyond those version thresholds.

PYSEC-2018-39: Input Validation

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are realistically exposed to this issue?

What does an attacker need to exploit it?

Which Ansible versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Which systems are realistically exposed to this issue?

What does an attacker need to exploit it?

Which Ansible versions are affected?