PYSEC-2019-2: Medium severity Ansible Ansible vulnerability

Q: What does an attacker need in order to exploit this issue?

The vulnerability requires low privileges and can be exploited over the network without user interaction. Exploitation relies on triggering unintended variable substitution in Ansible templating.

Q: What information could be exposed?

An attacker may disclose the contents of any variable through unexpected variable substitution. The provided data does not limit this exposure to a particular variable type or scope.

Q: Which Ansible versions need remediation?

Versions before 2.6.18, 2.7.12, and 2.8.2 are affected. Upgrade to the applicable fixed release or a later supported version.

Published Jul 30, 2019

Updated

A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.

Affected Software

1 affected component

Ansible Ansible<2.6.18, <2.7.12, <2.8.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ansible to a version that resolves this vulnerability.
Fixed in 2.6.18
Upgrade
Upgrade Ansible to a version that resolves this vulnerability.
Fixed in 2.7.12
Upgrade
Upgrade Ansible to a version that resolves this vulnerability.
Fixed in 2.8.2

Event History

Jul 30, 2019

CVE Published

via OSV·11:15 PM

Data Sourced

via OSV·11:15 PM

DescriptionSeverity

Frequently Asked Questions

What does an attacker need in order to exploit this issue?

The vulnerability requires low privileges and can be exploited over the network without user interaction. Exploitation relies on triggering unintended variable substitution in Ansible templating.

What information could be exposed?

An attacker may disclose the contents of any variable through unexpected variable substitution. The provided data does not limit this exposure to a particular variable type or scope.

Which Ansible versions need remediation?

Versions before 2.6.18, 2.7.12, and 2.8.2 are affected. Upgrade to the applicable fixed release or a later supported version.

PYSEC-2019-2: Medium severity Ansible Ansible vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need in order to exploit this issue?

What information could be exposed?

Which Ansible versions need remediation?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need in order to exploit this issue?

What information could be exposed?

Which Ansible versions need remediation?