REDHAT-BUG-980821
First published: Wed Jul 03 2013(Updated: )
A security flaw was found in the way Ansible, a SSH-based configuration management, deployment, and task execution system, performed remote server's SSH host key management (previously ability to store known SSH server's host keys to local cache was not supported). A remote attacker could use this flaw to conduct man-in-the-middle (MiTM) attacks against the Ansible task execution system user. References: [1] <a href="http://www.openwall.com/lists/oss-security/2013/07/01/2">http://www.openwall.com/lists/oss-security/2013/07/01/2</a> [2] <a href="http://www.openwall.com/lists/oss-security/2013/07/02/6">http://www.openwall.com/lists/oss-security/2013/07/02/6</a> Upstream bug (no upstream patch as of 2013-07-03): [3] <a href="https://github.com/ansible/ansible/issues/857">https://github.com/ansible/ansible/issues/857</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Ansible |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2013/07/01/2
- http://www.openwall.com/lists/oss-security/2013/07/02/6
- https://github.com/ansible/ansible/issues/857
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=980827
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=980828
- https://bugzilla.redhat.com/show_bug.cgi?id=980821
Frequently Asked Questions
What is the severity of REDHAT-BUG-980821?
The severity of REDHAT-BUG-980821 is classified as high due to the potential risk of a remote attacker exploiting SSH host key management flaws.
How do I fix REDHAT-BUG-980821?
To fix REDHAT-BUG-980821, ensure you are using an updated version of Ansible that addresses the SSH host key management vulnerability.
What systems are affected by REDHAT-BUG-980821?
REDHAT-BUG-980821 affects various versions of Ansible that utilize SSH for configuration management.
Can REDHAT-BUG-980821 lead to unauthorized access?
Yes, REDHAT-BUG-980821 can potentially lead to unauthorized access as it allows remote attackers to manipulate SSH host key management.
Is there a workaround for REDHAT-BUG-980821?
A temporary workaround for REDHAT-BUG-980821 involves manually managing known SSH host keys until an update can be applied.
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2013-2233
- agent/references
- agent/severity
- agent/last-modified-date
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/ansible
- canonical/ansible