Read the docs
TI-2019-11108 Aliases CVE-2019-14905GHSA-frxj-5j27-f8rf

Improper input validation in Red Hat Ansible

Priority LOW 26CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · Low
Fix status
Partial Red Hat: 7 fixed, 7 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

Why it matters now

EPSS 0.00713 53rd percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.7.16, 2.8.8, 2.9.3Red Hat: 4 advisoriesRed Hat: 7 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatAnsible2.9 to before 2.9.3; 2.8 to before 2.8.8; 2.7 to before 2.7.16; up to 2.7.x2.9.3, 2.8.8, 2.7.16Patch availableCNA
—ansible (PyPI)2.7.0a1 to before 2.7.162.7.16Patch availableGHSA-frxj-5j27-f8rf
—ansible (PyPI)2.8.0a1 to before 2.8.82.8.8Patch availableGHSA-frxj-5j27-f8rf
—ansible (PyPI)2.9.0a1 to before 2.9.32.9.3Patch availableGHSA-frxj-5j27-f8rf
  • Ansible VendorRed Hat Affected 2.9 to before 2.9.3; 2.8 to before 2.8.8; 2.7 to before 2.7.16; up to 2.7.x Fixed in 2.9.3, 2.8.8, 2.7.16 Patch available CNA
  • ansible (PyPI) Vendor— Affected 2.7.0a1 to before 2.7.16 Fixed in 2.7.16 Patch available GHSA-frxj-5j27-f8rf
  • ansible (PyPI) Vendor— Affected 2.8.0a1 to before 2.8.8 Fixed in 2.8.8 Patch available GHSA-frxj-5j27-f8rf
  • ansible (PyPI) Vendor— Affected 2.9.0a1 to before 2.9.3 Fixed in 2.9.3 Patch available GHSA-frxj-5j27-f8rf

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*2.7.0 to before 2.7.16; 2.8.0 to before 2.8.8; 2.9.0 to before 2.9.3VulnerableRed Hat
cpe:2.3:a:redhat:ansible_tower:3.0.0:*:*:*:*:*:*:*3.0.0VulnerableRed Hat
cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*3.0VulnerableRed Hat
cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*13VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*15.0 sp1VulnerableopenSUSE
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*15.1VulnerableopenSUSE
  • cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:* Versions 2.7.0 to before 2.7.16; 2.8.0 to before 2.8.8; 2.9.0 to before 2.9.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_tower:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:* Versions 15.0 sp1 Vulnerable ·openSUSE
  • cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE

Remediation

  • Fix · GHSA-frxj-5j27-f8rf ansible (PyPI) Fixed in 2.7.16 Advisory →
  • Fix · GHSA-frxj-5j27-f8rf ansible (PyPI) Fixed in 2.8.8 Advisory →
  • Fix · GHSA-frxj-5j27-f8rf ansible (PyPI) Fixed in 2.9.3 Advisory →

Red Hat 4 advisories

  • RHSA-2020:0218 Released 2020-01-23 · Red Hat rating Moderate
    Ansible security and bug fix update (2.9.4)
    • Red Hat Ansible Engine 2 for RHEL 7 ansible-2.9.4-1.el7ae, ansible-test-2.9.4-1.el7ae
    • Red Hat Ansible Engine 2 for RHEL 8 ansible-2.9.4-1.el8ae, ansible-test-2.9.4-1.el8ae
  • RHSA-2020:0216 Released 2020-01-23 · Red Hat rating Moderate
    Ansible security and bug fix update (2.8.8)
    • Red Hat Ansible Engine 2.8 for RHEL 7 Server ansible-2.8.8-1.el7ae
    • Red Hat Ansible Engine 2.8 for RHEL 8 ansible-2.8.8-1.el8ae
  • RHSA-2020:0215 Released 2020-01-23 · Red Hat rating Moderate
    Ansible security and bug fix update (2.9.4)
    • Red Hat Ansible Engine 2.9 for RHEL 7 Server ansible-2.9.4-1.el7ae, ansible-test-2.9.4-1.el7ae
    • Red Hat Ansible Engine 2.9 for RHEL 8 ansible-2.9.4-1.el8ae, ansible-test-2.9.4-1.el8ae
Show 1 more Red Hat advisories
  • RHSA-2020:0217 Released 2020-01-23 · Red Hat rating Moderate
    Ansible security and bug fix update (2.7.16)
    • Red Hat Ansible Engine 2.7 for RHEL 7 Server ansible-2.7.16-1.el7ae

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Tower 3AffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix planned: Out of support scope
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Ansible Engine 2 for RHEL 7Fixed RHSA-2020:0218
Red Hat Ansible Engine 2 for RHEL 8Fixed RHSA-2020:0218
Red Hat Ansible Engine 2.7 for RHEL 7 ServerFixed RHSA-2020:0217
Red Hat Ansible Engine 2.8 for RHEL 7 ServerFixed RHSA-2020:0216
Red Hat Ansible Engine 2.8 for RHEL 8Fixed RHSA-2020:0216
Red Hat Ansible Engine 2.9 for RHEL 7 ServerFixed RHSA-2020:0215
Red Hat Ansible Engine 2.9 for RHEL 8Fixed RHSA-2020:0215
Not affected: 1 product
  • CloudForms Management Engine 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-14905
  2. 2026-10-03 Alias added: GHSA-frxj-5j27-f8rf

References

Patch 3

Advisory 5

Other 3

  • TI-2018-05593 transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before… CVSS 3.1CRITICAL 9.8
  • TI-2017-05127 Improper input validation in [UNKNOWN] ansible CVSS 3.1CRITICAL 9.8
  • TI-2021-03523 Information disclosure in ansible CVSS 3.1HIGH 7.5
  • TI-2019-11051 Sensitive information in log files in Red Hat Ansible CVSS 3.1HIGH 7.8
  • TI-2018-07689 Untrusted search path in [UNKNOWN] ansible CVSS 3.1HIGH 7.8
  • TI-2018-07688 Untrusted search path in [UNKNOWN] ansible CVSS 3.0HIGH 7.8
See all 24 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences