7.6high
CVE-2016-8628
Ansible fails to properly sanitize fact variables sent from the Ansible controller
Also known as GHSA-jg4f-jqm5-4mgq, PYSEC-2018-38
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.6
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
3.2%
percentile 88%
Public exploits
0
none known
Summary
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
Exploit prediction (EPSS)
3.21% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 7.6 | CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H |
| CNA | 3.0 | 7.6 | CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H |
| NVD | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
| GitHub | 3.0 | 9.1 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | ansible | <2.2.0.0 | 2.2.0.0 |
Affected products
- Red Hat Ansible
Classification
- Weakness
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
- access.redhat.com /errata/RHSA-2016:2778 · vendor-advisory, x_refsource_REDHAT, x_transferred
- securityfocus.com /bid/94109 · vdb-entry, x_refsource_BID, x_transferred
- bugzilla.redhat.com /show_bug.cgi?id=CVE-2016-8628 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2016-8628 · advisory
- github.com /ansible/ansible/issues/41903 · web
- github.com /ansible/ansible/commit/35938b907dfcd1106ca40b794f0db446bdb8cf09 · web
- github.com /advisories/GHSA-jg4f-jqm5-4mgq · advisory
- github.com /ansible/ansible · package
- github.com /pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-38.yaml · web
- web.archive.org /web/20200227214455/http://www.securityfocus.com/bid/94109 · web
Sources
- CVE List: CVE-2016-8628
- GitHub Advisory: GHSA-jg4f-jqm5-4mgq
- NVD: CVE-2016-8628
- OSV: PYSEC-2018-38
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.