National Vulnerability Database

National Vulnerability Database

National Vulnerability

Search Results (Refine Search)

Search Parameters:
  • Contains Software Flaws (CVE)
  • CPE Product Version: cpe:/a:redhat:ansible_engine:2.0
There are 9 matching records.
Vuln ID Summary CVSS Severity

ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.

Published: January 03, 2019; 10:29:01 AM -05:00
V3: 7.5 HIGH
V2: 5.0 MEDIUM

Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' passwords to appear in EventLogs in plaintext. A local user with administrator privileges on the machine can view these logs and discover the plaintext password. Ansible Engine 2.8 and older are believed to be vulnerable.

Published: November 29, 2018; 01:29:00 PM -05:00
V3: 4.4 MEDIUM
V2: 2.1 LOW

Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen executable. Showing those credentials in clear text form for every user which have access just to the process list.

Published: October 23, 2018; 11:29:00 AM -04:00
V3: 7.8 HIGH
V2: 2.1 LOW

An input validation vulnerability was found in Ansible's mysql_user module before, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.

Published: July 26, 2018; 10:29:00 AM -04:00
V3: 4.9 MEDIUM
V2: 4.0 MEDIUM

Ansible before versions and fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.

Published: July 19, 2018; 09:29:00 AM -04:00
V2: 7.5 HIGH

A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.

Published: July 13, 2018; 06:29:00 PM -04:00
V2: 7.5 HIGH

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

Published: July 02, 2018; 09:29:00 PM -04:00
V3: 7.5 HIGH
V2: 5.0 MEDIUM

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

Published: July 02, 2018; 09:29:00 AM -04:00
V3: 7.8 HIGH
V2: 4.6 MEDIUM
CVE-2018-7750 in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

Published: March 13, 2018; 02:29:00 PM -04:00
V2: 7.5 HIGH