vulnwire
7.8high

CVE-2016-3096

Link Following in ansible

Also known as GHSA-rh6x-qvg7-rrmj, PYSEC-2016-1

Published 10 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.5%
percentile 41%
Public exploits
0
none known

The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.

Exploit prediction (EPSS)

0.47% probability of exploitation in the next 30 days, higher than 41% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.07.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD2.07.2AV:L/AC:L/Au:N/C:C/I:C/A:C
GitHub3.07.8CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
pypiansible
>=2.0.0.0, <2.0.2.0
<1.9.6.1
<2.0.2.0
2.0.2.0
1.9.6.1

Classification

Weakness
  • CWE-59 Improper Link Resolution Before File Access

References

  • bugzilla.redhat.com /show_bug.cgi?id=1322925 · x_refsource_CONFIRM, x_transferred
  • lists.fedoraproject.org /pipermail/package-announce/2016-April/183274.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • lists.fedoraproject.org /pipermail/package-announce/2016-April/183252.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • github.com /ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4 · x_refsource_CONFIRM, x_transferred
  • lists.fedoraproject.org /pipermail/package-announce/2016-May/184175.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • github.com /ansible/ansible/blob/v2.0.2.0-1/CHANGELOG.md#202-over-the-hills-and-far-away · x_refsource_CONFIRM, x_transferred
  • lists.fedoraproject.org /pipermail/package-announce/2016-April/183132.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • lists.fedoraproject.org /pipermail/package-announce/2016-April/183103.html · vendor-advisory, x_refsource_FEDORA, x_transferred
  • groups.google.com /forum/#%21topic/ansible-announce/tqiZbcWxYig · mailing-list, x_refsource_MLIST, x_transferred
  • security.gentoo.org /glsa/201607-14 · vendor-advisory, x_refsource_GENTOO, x_transferred
  • groups.google.com /forum/#%21topic/ansible-announce/E80HLZilTU0 · mailing-list, x_refsource_MLIST, x_transferred
  • github.com /ansible/ansible-modules-extras/pull/1941 · x_refsource_CONFIRM, x_transferred
  • github.com /ansible/ansible/blob/v1.9.6-1/CHANGELOG.md#196-dancing-in-the-street---tbd · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-3096 · advisory
  • github.com /ansible/ansible-modules-extras/commit/7c3999a92a1cd856ff9bc8913a93ff1aee8bffc3 · web
  • github.com /advisories/GHSA-rh6x-qvg7-rrmj · advisory
  • github.com /ansible/ansible · package
  • github.com /pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2016-1.yaml · web
  • groups.google.com /forum/#!topic/ansible-announce/E80HLZilTU0 · web
  • groups.google.com /forum/#!topic/ansible-announce/tqiZbcWxYig · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.