Multiple vulnerabilities have been found in Ansible, the worst of which could result in the arbitrary execution of code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/ansible | * | < 2.9.7 | >= 2.9.7 |
Ansible is a radically simple IT automation platform.
Multiple vulnerabilities have been discovered in Ansible. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All Ansible users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/ansible-2.9.7"
A vulnerability in Ansible may allow rogue clients to execute commands on the Ansible controller.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/ansible | * | < 2.1.4.0_rc3, < 2.2.1.0_rc5 | >= 2.1.4.0_rc3, >= 2.2.1.0_rc5 |
Ansible is a radically simple IT automation platform.
An input validation vulnerability was found in Ansible’s handling of data sent from client systems.
An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could execute arbitrary code on the Ansible server using the Ansible-server privileges.
There is no known workaround at this time.
All Ansible 2.1.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/ansible-2.1.4.0_rc3"
All Ansible 2.2.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/ansible-2.2.1.0_rc5"
A vulnerability in Ansible may allow local attackers to gain escalated privileges or write arbitrary files.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/ansible | * | < 2.0.2.0-r1 | >= 2.0.2.0-r1, >= 1.9.6 (revision) |
Ansible is a radically simple IT automation platform.
The create_script function in the lxc_container module of Ansible uses predictable temporary file names, making it vulnerable to a symlink attack.
Local attackers could write arbitrary files or gain escalated privileges within the container.
There is no known workaround at this time.
All Ansible 1.9.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/ansible-1.9.6"
All Ansible 2.0.2.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/ansible-2.0.2.0-r1"
Multiple vulnerabilities has been found in Ansible which may allow local privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-admin/ansible | * | < 1.6.8 | >= 1.6.8 |
Ansible is a radically simple IT automation platform.
Multiple vulnerabilities have been discovered in Ansible. Please review the CVE identifiers referenced below for details.
A local attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service condition, or obtain sensitive information.
There is no known workaround at this time.
All Ansible users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/ansible-1.6.8"