Red Hat Security Advisory

RHSA-2018:2585

ansible security update

Released 2018-08-29 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat OpenStack Platform 13.0 ansible-2.4.6.0-1.el7ae

Fixes 3 records

TI-2018-07689 CVE-2018-10875 · GHSA-fc4h-467w-46rh

Untrusted search path in [UNKNOWN] ansible

LOW 35

A flaw was found in ansible.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00587 Published 2018-07-13 Partial fix · 2.4.6.0, 2.5.6 +1 CWE-426

TI-2018-07688 CVE-2018-10874 · GHSA-3xvg-x47j-x75w

Untrusted search path in [UNKNOWN] ansible

LOW 35

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00485 Published 2018-07-02 Partial fix · 2.4.6.0, 2.5.6 +1 CWE-426

TI-2018-07669 CVE-2018-10855 · GHSA-jwcc-j78w-j73w

Sensitive information in log files in [UNKNOWN] ansible

LOW 32

Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.03088 Published 2018-07-02 Partial fix · 2.5.5, 2.4.5.0 CWE-532