CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4659
https://notcve.org/view.php?id=CVE-2014-4659
20 Feb 2020 — Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by reading a file that uses the "deb http://user:pass@server:port/" format. Ansible versiones anteriores a 1.5.5, establece los permisos 0644 para sources.list, lo que podría permitir a usuarios locales obtener información confidencial de credenciales en circunstancias oportunistas mediante la lectura de un archivo que utiliza el formato "deb ht... • https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md • CWE-522: Insufficiently Protected Credentials •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4658
https://notcve.org/view.php?id=CVE-2014-4658
20 Feb 2020 — The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local users to obtain sensitive key information by reading a file. El subsistema vault en Ansible versiones anteriores a 1.5.5, no establece el umask antes de la creación o modificación de un archivo vault, lo que permite a usuarios locales obtener información confidencial de claves mediante la lectura de un archivo. • https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-4660
https://notcve.org/view.php?id=CVE-2014-4660
20 Feb 2020 — Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow local users to obtain sensitive credential information in opportunistic circumstances by leveraging existence of a file that uses the "deb http://user:pass@server:port/" format. Ansible versiones anteriores a 1.5.5, construye nombres de archivos que contienen campos de usuario y contraseña sobre la base de líneas deb en sources.list, lo que podría permitir a usuarios loc... • https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.3EPSS: 0%CPEs: 5EXPL: 0CVE-2019-14904 – Ansible: vulnerability in solaris_zone module via crafted solaris zone
https://notcve.org/view.php?id=CVE-2019-14904
23 Jan 2020 — A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected. Se encontró un fallo en el módulo solaris_zone de los módulos d... • https://bugzilla.redhat.com/show_bug.cgi?id=1776944 • CWE-20: Improper Input Validation CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2014-2686
https://notcve.org/view.php?id=CVE-2014-2686
09 Jan 2020 — Ansible prior to 1.5.4 mishandles the evaluation of some strings. Ansible versiones anteriores a 1.5.4, maneja inapropiadamente la evaluación de algunas cadenas. • https://groups.google.com/forum/#%21searchin/ansible-project/1.5.4/ansible-project/MUQxiKwSQDc/id6aVaawVboJ • CWE-670: Always-Incorrect Control Flow Implementation •
CVSS: 5.5EPSS: 0%CPEs: 7EXPL: 0CVE-2019-10156 – ansible: unsafe template evaluation of returned module data can lead to information disclosure
https://notcve.org/view.php?id=CVE-2019-10156
09 Jul 2019 — A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed. Se detectó un fallo en la manera en que fueron implementadas las plantillas de Ansible en versiones anteriores a 2.6.18, 2.7.12 y 2.8.2, causando la posibilidad de revelación de información mediante la sus... • https://access.redhat.com/errata/RHSA-2019:3744 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2016-8614
https://notcve.org/view.php?id=CVE-2016-8614
31 Jul 2018 — A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key. Se ha descubierto un problema en versiones anteriores a la 2.2.0 de Ansible. El módulo apt_key no verifica correctamente las huellas de la clave, lo que permite que un adversario remoto cree una clave de OpenPGP que coincide con el ID de clave corto y la inyecte en luga... • http://www.securityfocus.com/bid/94108 • CWE-320: Key Management Errors CWE-358: Improperly Implemented Security Check for Standard •
CVSS: 7.4EPSS: 0%CPEs: 1EXPL: 0CVE-2013-2233
https://notcve.org/view.php?id=CVE-2013-2233
04 May 2018 — Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys. Ansible en versiones anteriores a la 1.2.1 facilita que atacantes remotos lleven a cabo ataques Man-in-the-Middle (MitM) aprovechando el error a la hora de cachear claves de host SSH. • http://www.openwall.com/lists/oss-security/2013/07/01/2 • CWE-320: Key Management Errors •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2014-3498
https://notcve.org/view.php?id=CVE-2014-3498
08 Jun 2017 — The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands. El módulo de usuario en ansible, versiones anteriores a la 1.6.6, permite a usuarios remotos autenticados ejecutar comandos arbitrarios. • https://bugzilla.redhat.com/show_bug.cgi?id=1335551 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-6240
https://notcve.org/view.php?id=CVE-2015-6240
07 Jun 2017 — The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack. Los plugins chroot, jail, y zone connection en Ansible anterior a versión 1.9.2 permiten a los usuarios locales escapar de un entorno restringido por medio de un ataque de enlace simbólico (symlink). • http://www.openwall.com/lists/oss-security/2015/08/17/10 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •