NetSight
IP …
medium5.6

CVE-2019-14905

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy…

Impact

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

Affected products

VendorProductAffected versions
RedhatAnsible Engine
from 2.7.0 before 2.7.16
from 2.8.0 before 2.8.8
from 2.9.0 before 2.9.3
RedhatAnsible Tower
Version 3.0.0
RedhatCeph Storage
Version 3.0
RedhatCloudforms Management Engine
Version 5.0
RedhatOpenstack
Version 13
FedoraprojectFedora
Version 30
OpensuseBackports Sle
Version 15.0
OpensuseLeap
Version 15.1

Weakness classification

CWE-20CWE-73CWE-668

References