CVE-2017-7466
ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587)
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
Ansible en versiones anteriores a la 2.3 tiene una vulnerabilidad de validación de entradas en la gestión de datos enviados desde los sistemas del cliente. Un atacante que tenga el control de un sistema de cliente gestionado por Ansible y la capacidad de enviar hechos de vuelta al servidor de Ansible podría usar este error para ejecutar código arbitrario en el servidor de Ansible utilizando los privilegios del servidor de Ansible.
An input validation vulnerability was found in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-04-05 CVE Reserved
- 2017-05-18 CVE Published
- 2024-06-01 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-20: Improper Input Validation
CAPEC
References (10)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/97595 | Third Party Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7466 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2017:1244 | 2021-08-04 | |
| https://access.redhat.com/errata/RHSA-2017:1334 | 2021-08-04 | |
| https://access.redhat.com/errata/RHSA-2017:1476 | 2021-08-04 | |
| https://access.redhat.com/errata/RHSA-2017:1499 | 2021-08-04 | |
| https://access.redhat.com/errata/RHSA-2017:1599 | 2021-08-04 | |
| https://access.redhat.com/errata/RHSA-2017:1685 | 2021-08-04 | |
| https://access.redhat.com/security/cve/CVE-2017-7466 | 2017-07-06 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1439212 | 2017-07-06 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Ansible Search vendor "Redhat" for product "Ansible" | < 2.3 Search vendor "Redhat" for product "Ansible" and version " < 2.3" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openstack Search vendor "Redhat" for product "Openstack" | 10 Search vendor "Redhat" for product "Openstack" and version "10" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Openstack Search vendor "Redhat" for product "Openstack" | 11 Search vendor "Redhat" for product "Openstack" and version "11" | - |
Affected
| ||||||