The safeeval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
It was reported that user module in ansible before 1.6.6 is vulnerable to command execution. Ansible can get the result of remote command in variable, which may come from untrusted source of input. The content of variable isn't properly filtered and when attempting to use the variable, it will trigger a function that passes it through jinja 2 template engine that can result into arbitrary command execution. Under certain circumstances, unprivileged user on system that is being managed via ansible can execute code on the managing host under UID of running ansible process.
Upstream patch:
https://github.com/ansible/ansible/commit/8ed6350e65c82292a631f08845dfaacffe7f07f5
Last updated 10 March 2025
A flaw was found in Ansible before version 2.2.0. The aptkey module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
Ansible prior to 1.5.4 mishandles the evaluation of some strings.
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.
A security flaw was found in the way Ansible, a SSH-based configuration management, deployment, and task execution system, performed remote server's SSH host key management (previously ability to store known SSH server's host keys to local cache was not supported). A remote attacker could use this flaw to conduct man-in-the-middle (MiTM) attacks against the Ansible task execution system user.
References: [1] http://www.openwall.com/lists/oss-security/2013/07/01/2 [2] http://www.openwall.com/lists/oss-security/2013/07/02/6
Upstream bug (no upstream patch as of 2013-07-03): [3] https://github.com/ansible/ansible/issues/857
A flaw was found in Ansible Base when using the awsssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service availability.
lib/ansible/playbook/init.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/.
A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucketpipelinevariable module. This flaw allows an attacker to steal bitbucketpipeline credentials. The highest threat from this vulnerability is to confidentiality.
A flaw was found in Ansible Base when using the awsssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confidentiality.
Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@server:port/" format.
The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file.
This CVE affects Ansible and is similar to CVE-2024-0690. The vulnerability arises due to improper handling of sensitive variables loaded from Ansible Vault files, potentially leading to the exposure of secret data during execution.
runner/connectionplugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.
A flaw was found in Ansible. Three API endpoints are accessible and return verbose, unauthenticated responses. This flaw allows a malicious user to access data that may contain important information.
A flaw was found in Ansible. Three API endpoints were accessed and returned verbose, unauthenticated responses, which may contain important information for an malicious user to perform other attacks.
Fixed an XSS vulnerability (CVE-2020-25626) Fixed the Red Hat sosreport tool to no longer include the Ansible Tower SECRETKEY value Fixed the Ansible Tower installer so that it is now compatible with the latest supported Red Hat OpenShift Container Platforms 3.x and 4.x
<li> Updated to the latest version of the git-python library to no longer cause certain jobs to fail</li> <li> Updated to the latest version of the ovirt.ovirt collection to no longer cause connections to hang when syncing inventory from oVirt/RHV</li> <li> Added a number of optimizations to Ansible Tower's callback receiver to improve the speed of stdout processing for simultaneous playbooks runs</li> <li> Added an optional setting to disable the auto-creation of organizations and teams on successful SAML login</li> <li> Fixed an XSS vulnerability (CVE-2020-25626)</li> <li> Fixed a slow memory leak in the Daphne process</li> <li> Fixed Automation Analytics data gathering to no longer fail for customers with large datasets</li> <li> Fixed scheduled jobs that run every X minute(s) or hour(s) to no longer fail to run at the proper time</li> <li> Fixed delays in Ansible Tower's task manager when large numbers of simultaneous jobs are scheduled</li> <li> Fixed the performance for playbooks that store large amounts of data using the setstats module</li> <li> Fixed the awx-manage removefromqueue tool when used with isolated nodes</li> <li> Fixed an issue that prevented jobs from being properly marked as canceled when Tower is backed up and then restored to another environment</li>
Added additional metrics to the Prometheus /api/v2/metrics/ endpoint for reporting remaining instance capacity Fixed Tower to allow users to subscribe to playbook output in organizations they do not have RBAC access to via Towers websocket interface (CVE-2020-10698) Fixed OAuth2 refresh tokens to properly respect custom expiration settings (CVE-2020-10709) Fixed event hostnames to be recorded for playbooks run on isolated nodes Fixed a PostgreSQL issue that caused upgrade failures in certain situations Fixed the search for Source Control credentials in the Tower user interface Fixed a performance issue to no longer delay the output of project updates for certain users Fixed the installations to no longer fail with admin passwords that contain certain special characters Fixed the start time to correctly set for approval notifications Fixed an inconsistency in gathered inventory analytics Improved memcached in OpenShift deployments to listen on a more secure domain socket (CVE-2020-10697) Updated single sign-on integration to address several upcoming GitHub API deprecations Updated the Twisted library to address CVE-2020-10108 and CVE-2020-10109 Updated translations
End of life: 5/20/2024, Latest version: 2.14.18
End of life: 5/20/2024, Latest version: 2.14.18
End of life: 5/22/2023, Latest version: 2.12.10
End of life: 5/22/2023, Latest version: 2.12.10
End of life: 11/6/2023, Latest version: 2.13.13
End of life: 11/6/2023, Latest version: 2.13.13
End of life: 11/30/2024, Latest version: 2.15.13
End of life: 11/30/2024, Latest version: 2.15.13
End of life: 11/7/2022, Latest version: 2.11.12