Description
The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ansible | 2.0.1.0-2 | — |
| Debian 13 | ansible | 2.0.1.0-2 | — |
| Debian 12 | ansible | 2.0.1.0-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | ansible | 2.0.0.2-2ubuntu1.3 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ansible | 2.2.0.0-1.1 | openSUSE-SU-2024:10326-1 |
| openSUSE Tumbleweed | ansible-10 | 10.6.0-1.1 | openSUSE-SU-2024:14536-1 |
| openSUSE Tumbleweed | ansible-11 | 11.11.0-1.1 | openSUSE-SU-2025:15605-1 |
| openSUSE Tumbleweed | ansible-12 | 12.2.0-1.1 | openSUSE-SU-2025:15753-1 |
| openSUSE Tumbleweed | ansible-13 | 13.7.0-1.1 | openSUSE-SU-2026:10944-1 |
| openSUSE Tumbleweed | ansible-14 | 14.6.0-1.1 | openSUSE-SU-2026:12447-1 |
| openSUSE Tumbleweed | ansible-9 | 9.8.0-1.1 | openSUSE-SU-2024:14244-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ansible | >= 2.0.0.0, < 2.0.2.0 | 2.0.2.0 | GHSA-rh6x-qvg7-rrmj |
| PyPI | ansible | < 1.9.6.1 | 1.9.6.1 | GHSA-rh6x-qvg7-rrmj |
| PyPI | ansible | < 2.0.2.0 | 2.0.2.0 | PYSEC-2016-1 |
Advisories 7
- openSUSE-SU-2026:12447-1 ansible-14-14.6.0-1.1 on GA media SUSE / openSUSE Security Updates · Nov 7, 2026
- openSUSE-SU-2026:10944-1 ansible-13-13.7.0-1.1 on GA media SUSE / openSUSE Security Updates · Jun 4, 2026
- openSUSE-SU-2025:15605-1 ansible-11-11.11.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2025:15753-1 ansible-12-12.2.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10326-1 ansible-2.2.0.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14536-1 ansible-10-10.6.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14244-1 ansible-9-9.8.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1322925
- FEDORA-2016-cd3cf8e7d0 vendor-advisory
- FEDORA-2016-ab154c56dd vendor-advisory
- https://github.com/ansible/ansible-modules-extras/pull/1941/commits/8c6fe646ee79f5e55361b885b7efed5bec72d4a4
- FEDORA-2016-679c4ddd3c vendor-advisory
- https://github.com/ansible/ansible/blob/v2.0.2.0-1/CHANGELOG.md#202-over-the-hills-and-far-away
- FEDORA-2016-65519440f5 vendor-advisory
- FEDORA-2016-28ff51a3f5 vendor-advisory
- [ansible-announce] 20160415 Ansible 1.9.6-1 has been released mailing-list
- GLSA-201607-14 vendor-advisory
- [ansible-announce] 20160419 Ansible 2.0.2.0 has been released mailing-list
- https://github.com/ansible/ansible-modules-extras/pull/1941
- https://github.com/ansible/ansible/blob/v1.9.6-1/CHANGELOG.md#196-dancing-in-the-street---tbd