critical8.1Public exploit code
CVE-2016-9587
Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Ansible 2.1.4/2.2.1 - Command Execution2017-01-09 · remote · linux
Impact
Ansible before versions 2.1.4.0, 2.2.1.0 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | ansible | <= 2.1.3.0 | 2.1.4.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Ansible | before 2.1.4 |
| Ansible | Ansible | before 2.2.1 |
| Redhat | Openstack | Version 11 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://rhn.redhat.com/errata/RHSA-2017-0195.html
- http://rhn.redhat.com/errata/RHSA-2017-0260.html
- http://www.securityfocus.com/bid/95352
- https://access.redhat.com/errata/RHSA-2017:0448
- https://access.redhat.com/errata/RHSA-2017:0515
- https://access.redhat.com/errata/RHSA-2017:1685
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9587
- https://security.gentoo.org/glsa/201701-77
- https://www.exploit-db.com/exploits/41013/
- https://github.com/advisories/GHSA-m956-frf4-m2wr
- https://nvd.nist.gov/vuln/detail/CVE-2016-9587
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-39.yaml
- https://web.archive.org/web/20170115210655/http://www.securityfocus.com/bid/95352
- https://www.exploit-db.com/exploits/41013