NetSight
IP …
high7.8

CVE-2018-10874

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allo…

Impact

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

Affected products

VendorProductAffected versions
RedhatAnsible Engine
Versions 2.0, 2.4, 2.5, 2.6
RedhatOpenstack
Versions 10, 12, 13
RedhatVirtualization
Version 4.0
RedhatVirtualization Host
Version 4.0

Weakness classification

CWE-426CWE-20

References