PYSEC-2019-146: Medium severity Ansible Ansible vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is network-accessible and has low attack complexity. The attacker must already have low-level privileges; no user interaction is required.

Q: What is the expected security impact if exploitation succeeds?

The provided vector indicates a high confidentiality impact. Integrity and availability impacts are not indicated.

Q: What version should be used to remediate the issue?

Upgrade from affected releases to the applicable fixed release: 2.8.6, 2.7.14, or 2.6.20, depending on the release branch in use.

Published Nov 26, 2019

Updated

ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None

Affected Software

1 affected component

Ansible Ansible<2.8.6, <2.7.14, <2.6.20

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ansible to a version that resolves this vulnerability.
Fixed in 2.8.6
Upgrade
Upgrade ansible to a version that resolves this vulnerability.
Fixed in 2.7.14
Upgrade
Upgrade ansible to a version that resolves this vulnerability.
Fixed in 2.6.20

Event History

Nov 26, 2019

CVE Published

via OSV·02:15 PM

Data Sourced

via OSV·02:15 PM

DescriptionSeverity

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is network-accessible and has low attack complexity. The attacker must already have low-level privileges; no user interaction is required.

What is the expected security impact if exploitation succeeds?

The provided vector indicates a high confidentiality impact. Integrity and availability impacts are not indicated.

What version should be used to remediate the issue?

Upgrade from affected releases to the applicable fixed release: 2.8.6, 2.7.14, or 2.6.20, depending on the release branch in use.

PYSEC-2019-146: Medium severity Ansible Ansible vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the expected security impact if exploitation succeeds?

What version should be used to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

What is the expected security impact if exploitation succeeds?

What version should be used to remediate the issue?