GHSA-fc4h-467w-46rh CVE-2018-10875 PYSEC-2018-43
Ansible Arbitrary Code Execution
High
PyPI
- Severity
- 0.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.59%
- Chance of exploitation in the next 30 days. Higher than 48.33% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-426 Untrusted Search Path
- Fix
2.4.6.0- Upgrade ansible to this version or later
Description
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| ansible | < 2.4.6.0 |
2.4.6.0 |
| ansible | >= 2.5.0a1, < 2.5.6 |
2.5.6 |
| ansible | >= 2.6.0a1, < 2.6.1 |
2.6.1 |
| ansible | >= 2.5, < 2.5.6>= 2.4, < 2.4.6.0>= 2.6, < 2.6.1 |
2.4.6.02.5.62.6.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ansible PyPI → 2.4.6.0
- pip
pip install --upgrade "ansible>=2.4.6.0"- poetry
poetry add "ansible>=2.4.6.0"- uv
uv add "ansible>=2.4.6.0"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Local
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- Low
- User interaction
- None
- Confidentiality (vulnerable system)
- High
- Integrity (vulnerable system)
- High
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 7.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-426: Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
How to prevent it
- Architecture and Design, Implementation: Hard-code the search path to a set of known-safe values (such as system directories), or only allow them to be specified by the administrator in a configuration file. Do not allow these settings to be modified by an external party. Be careful to avoid related weaknesses such as CWE-426 and CWE-428.
- Implementation: When invoking other programs, specify those programs using fully-qualified pathnames. While this is an effective approach, code that uses fully-qualified pathnames might not be portable to other systems that do not use the same pathnames. The portability can be improved by locating the full-qualified paths in a centralized, easily-modifiable location within the source code, and having the code refer to these paths.
- Implementation: Remove or restrict all environment settings before invoking other programs. This includes the PATH environment variable, LD_LIBRARY_PATH, and other settings that identify the location of code libraries, and any application-specific search paths.
- Implementation: Check your search path before use and remove any elements that are likely to be unsafe, such as the current working directory or a temporary files directory.
- Implementation: Use other functions that require explicit paths. Making use of any of the other readily available functions that require explicit paths is a safe way to avoid this problem. For example, system() in C does not require a full path since the shell can take care of it, while execl() and execv() require a full path.
References
Advisories
Packages
Other links
- github.com/ansible/ansible/issues/42388
- github.com/ansible/ansible/pull/43583
- github.com/ansible/ansible/pull/42070
- github.com/ansible/ansible/commit/ff980afefdbe4ceb828bdb1bb2eef03cf616bf63
- github.com/ansible/ansible/commit/4cecbe81adbc655d7ab734165d3ac539f8ba5981
- github.com/ansible/ansible/commit/f32c42c37aaf7b9db93ea3151b2f42a0c4bd8172
- debian.org/security/2019/dsa-4396
- web.archive.org/web/20201130165946/http://www.securitytracker.com/id/1041396
- usn.ubuntu.com/4072-1
- lists.debian.org/debian-lts-announce/2019/09/msg00016.html
- github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-43.yaml
- bugzilla.redhat.com/show_bug.cgi
- access.redhat.com/errata/RHSA-2019:0054
- access.redhat.com/errata/RHSA-2018:2585
- access.redhat.com/errata/RHSA-2018:2321
- access.redhat.com/errata/RHSA-2018:2166
- access.redhat.com/errata/RHSA-2018:2152
- access.redhat.com/errata/RHSA-2018:2151
- access.redhat.com/errata/RHSA-2018:2150
- access.redhat.com/errata/RHBA-2018:3788
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html
- securitytracker.com/id/1041396
- usn.ubuntu.com/4072-1
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-8ggh-xwr9-3373 Ansible Community General Collection is vulnerable to exposure of sensitive information | Medium | Also affects ansible |
| GHSA-jpvw-p8pr-9g2x Ansible symlink attack vulnerability | Medium | Also affects ansible |
| GHSA-cpx3-93w7-457x Ansible leaks password to logs | High | Also affects ansible |
| GHSA-fh5v-5f35-2rv2 Insertion of Sensitive Information into Log File in ansible | Medium | Also affects ansible |
| GHSA-4r65-35qq-ch8j Ansible discloses sensitive information in traceback error message | Medium | Also affects ansible |
| GHSA-2pfh-q76x-gwvm Improper Input Validation and Command Injection in Ansible | High | Also affects ansible |
| PYSEC-2021-126 A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory. | Not rated yet | Also affects ansible |
| GHSA-r6h7-5pq2-j77h Insufficiently random values in Ansible | Medium | Also affects ansible |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor