vulnwire
2.2low

CVE-2016-8647

Improper Input Validation in ansible

Also known as GHSA-x4cm-m36h-c6qj, PYSEC-2018-58

Published 8 y ago · modified 4 mo ago · JSON

CVSS
2.2
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.4%
percentile 73%
Public exploits
0
none known

An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.

Exploit prediction (EPSS)

1.44% probability of exploitation in the next 30 days, higher than 73% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.02.2CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
NVD3.14.9CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
CNA3.02.2CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
NVD2.04.0AV:N/AC:L/Au:S/C:N/I:P/A:N
GitHub3.04.9CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Affected packages

EcosystemPackageAffectedFixed in
pypiansible
<2.2.1.0
2.2.1.0

Affected products

  • Red Hat Ansible

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • access.redhat.com /errata/RHSA-2017:1685 · vendor-advisory, x_refsource_REDHAT, x_transferred
  • github.com /ansible/ansible-modules-core/pull/5388 · x_refsource_CONFIRM, x_transferred
  • bugzilla.redhat.com /show_bug.cgi?id=CVE-2016-8647 · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-8647 · advisory
  • github.com /ansible/ansible-modules-core/commit/30fb384e7fb9a94ac3929e4a650877e45d8834c9 · web
  • access.redhat.com /security/cve/CVE-2016-8647 · web
  • bugzilla.redhat.com /show_bug.cgi?id=1396174 · web
  • github.com /advisories/GHSA-x4cm-m36h-c6qj · advisory
  • github.com /ansible/ansible · package
  • github.com /pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-58.yaml · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.