Red Hat Security Advisory: Ansible security and bug fix update (2.8.8)

Fixed packages 2

Vulnerabilities 2

• High 7.3
  CVE-2019-14904

  OS Command Injection and Improper Input Validation in ansible

  A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take ad…

  ansible ansible ansible ansible Debian Ubuntu Alpine PyPI
  Aug 25, 2020
• High 7.3
  CVE-2019-14905

  Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible

  A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craf…

  Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  Mar 31, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1776943
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1776944
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0216.json
• report
  https://access.redhat.com/security/cve/CVE-2019-14904
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-14904
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-14904
• report
  https://access.redhat.com/security/cve/CVE-2019-14905
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-14905
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-14905