Red Hat Security Advisory

RHSA-2018:2166

ansible security and bug fix update

Released 2018-07-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Ansible Engine 2.6 for RHEL 7 Server ansible-2.6.1-1.el7ae

Fixes 2 records

TI-2018-07689 CVE-2018-10875 · GHSA-fc4h-467w-46rh

Untrusted search path in [UNKNOWN] ansible

LOW 35

A flaw was found in ansible.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00587 Published 2018-07-13 Partial fix · 2.4.6.0, 2.5.6 +1 CWE-426

TI-2018-07688 CVE-2018-10874 · GHSA-3xvg-x47j-x75w

Untrusted search path in [UNKNOWN] ansible

LOW 35

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00485 Published 2018-07-02 Partial fix · 2.4.6.0, 2.5.6 +1 CWE-426