Read the docs
TI-2019-11107 Aliases CVE-2019-14904GHSA-gwr8-5j83-483c

Improper input validation in Ansible

Priority LOW 32CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · Low · Low
Fix status
Partial Red Hat: 7 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-78.

Summary

A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.

Why it matters now

EPSS 0.00418 36th percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.7.16, 2.8.8, 2.9.3Red Hat: 4 advisoriesRed Hat: 7 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—AnsibleAll versions before ansible-engine 2.9.4, before ansible-engine 2.8.8 and before ansible-engine 2.7.16—No fix listedCNA
—ansible (PyPI)before 2.7.162.7.16Patch availableGHSA-gwr8-5j83-483c
—ansible (PyPI)2.8.0a1 to before 2.8.82.8.8Patch availableGHSA-gwr8-5j83-483c
—ansible (PyPI)2.9.0a1 to before 2.9.32.9.3Patch availableGHSA-gwr8-5j83-483c
  • Ansible Vendor— Affected All versions before ansible-engine 2.9.4, before ansible-engine 2.8.8 and before ansible-engine 2.7.16 Fixed in — No fix listed CNA
  • ansible (PyPI) Vendor— Affected before 2.7.16 Fixed in 2.7.16 Patch available GHSA-gwr8-5j83-483c
  • ansible (PyPI) Vendor— Affected 2.8.0a1 to before 2.8.8 Fixed in 2.8.8 Patch available GHSA-gwr8-5j83-483c
  • ansible (PyPI) Vendor— Affected 2.9.0a1 to before 2.9.3 Fixed in 2.9.3 Patch available GHSA-gwr8-5j83-483c

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*before 2.7.15; 2.8.0 to before 2.8.7; 2.9.0 to before 2.9.2VulnerableRed Hat
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* Versions before 2.7.15; 2.8.0 to before 2.8.7; 2.9.0 to before 2.9.2 Vulnerable ·Red Hat
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-gwr8-5j83-483c ansible (PyPI) Fixed in 2.7.16 Advisory →
  • Fix · GHSA-gwr8-5j83-483c ansible (PyPI) Fixed in 2.8.8 Advisory →
  • Fix · GHSA-gwr8-5j83-483c ansible (PyPI) Fixed in 2.9.3 Advisory →

Red Hat 4 advisories

  • RHSA-2020:0218 Released 2020-01-23 · Red Hat rating Moderate
    Ansible security and bug fix update (2.9.4)
    • Red Hat Ansible Engine 2 for RHEL 7 ansible-2.9.4-1.el7ae, ansible-test-2.9.4-1.el7ae
    • Red Hat Ansible Engine 2 for RHEL 8 ansible-2.9.4-1.el8ae, ansible-test-2.9.4-1.el8ae
  • RHSA-2020:0216 Released 2020-01-23 · Red Hat rating Moderate
    Ansible security and bug fix update (2.8.8)
    • Red Hat Ansible Engine 2.8 for RHEL 7 Server ansible-2.8.8-1.el7ae
    • Red Hat Ansible Engine 2.8 for RHEL 8 ansible-2.8.8-1.el8ae
  • RHSA-2020:0215 Released 2020-01-23 · Red Hat rating Moderate
    Ansible security and bug fix update (2.9.4)
    • Red Hat Ansible Engine 2.9 for RHEL 7 Server ansible-2.9.4-1.el7ae, ansible-test-2.9.4-1.el7ae
    • Red Hat Ansible Engine 2.9 for RHEL 8 ansible-2.9.4-1.el8ae, ansible-test-2.9.4-1.el8ae
Show 1 more Red Hat advisories
  • RHSA-2020:0217 Released 2020-01-23 · Red Hat rating Moderate
    Ansible security and bug fix update (2.7.16)
    • Red Hat Ansible Engine 2.7 for RHEL 7 Server ansible-2.7.16-1.el7ae

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Tower 3AffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix planned: Out of support scope
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Ansible Engine 2 for RHEL 7Fixed RHSA-2020:0218
Red Hat Ansible Engine 2 for RHEL 8Fixed RHSA-2020:0218
Red Hat Ansible Engine 2.7 for RHEL 7 ServerFixed RHSA-2020:0217
Red Hat Ansible Engine 2.8 for RHEL 7 ServerFixed RHSA-2020:0216
Red Hat Ansible Engine 2.8 for RHEL 8Fixed RHSA-2020:0216
Red Hat Ansible Engine 2.9 for RHEL 7 ServerFixed RHSA-2020:0215
Red Hat Ansible Engine 2.9 for RHEL 8Fixed RHSA-2020:0215
Not affected: 1 product
  • CloudForms Management Engine 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-14904
  2. 2026-10-03 Alias added: GHSA-gwr8-5j83-483c

References

Patch 1

Advisory 5

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences