Summary
It was discovered that Ansible did not properly verify certain fields of
X.509 certificates. An attacker could possibly use this issue to spoof
SSL servers if they were able to intercept network communications. This
issue only affected Ubuntu 14.04 LTS. (CVE-2015-3908)
Martin Carpenter discovered that certain connection plugins for Ansible
did not properly restrict users. An attacker with local access could
possibly use this issue to escape a restricted environment via symbolic
links misuse. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-6240)
Robin Schneider discovered that Ansible's apt_key module did not properly
verify key fingerprints. A remote attacker could possibly use this issue
to perform key injection, leading to the access of sensitive information.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-8614)
It was discovered that Ansible would expose passwords in certain
instances. An attacker could possibly use specially crafted input related
to this issue to access sensitive information. This issue only affected
Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-10206)
It was discovered that Ansible incorrectly logged sensitive information.
An attacker with local access could possibly use this issue to access
sensitive information. This issue only affected Ubuntu 14.04 LTS, Ubuntu
16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2019-14846)
It was discovered that Ansible's solaris_zone module accepted input without
performing input checking. A remote attacker could possibly use this issue
to enable the execution of arbitrary code. This issue only affected Ubuntu
16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-14904)
It was discovered that Ansible did not generate sufficiently random values,
which could lead to the exposure of passwords. An attacker could possibly
use this issue to access sensitive information. This issue only affected
Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-10729)
It was discovered that Ansible's svn module could disclose passwords to
users within the same node. An attacker could possibly use this issue to
access sensitive information. (CVE-2020-1739)
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | ansible | 1.5.4+dfsg-1ubuntu0.1~esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ansible | 2.0.0.2-2ubuntu1.3+esm5 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | ansible | 2.5.1+dfsg-1ubuntu0.1+esm5 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ansible | 2.9.6+dfsg-1ubuntu0.1~esm3 |
Vulnerabilities 8
-
High 7.8
Ansible Sandbox Escape via Symlink Attack
The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.
-
High 7.5
Ansible does not verify that the server hostname matches a domain name in certificates
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certif…
-
High 7.3
Ansible Uses Plugins That Disclose Credentials
In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. …
-
High 7.3
OS Command Injection and Improper Input Validation in ansible
A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take ad…
-
Medium 6.4
Ansible password prompts could expose passwords
ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent…
-
Medium 6.3
Ansible apt_key module does not properly verify key fingerprint
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
-
Medium 5.0
Insufficiently random values in Ansible
A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulne…
-
Low 3.9
Exposure of Sensitive Information to an Unauthorized Actor in Ansible
A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advant…
References
-
report
https://ubuntu.com/security/CVE-2015-3908
-
report
https://ubuntu.com/security/CVE-2015-6240
-
report
https://ubuntu.com/security/CVE-2016-8614
-
report
https://ubuntu.com/security/CVE-2019-10206
-
report
https://ubuntu.com/security/CVE-2019-14846
-
report
https://ubuntu.com/security/CVE-2019-14904
-
report
https://ubuntu.com/security/CVE-2020-1739
-
report
https://ubuntu.com/security/CVE-2020-10729