CVE-2018-10874

ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution

Severity Score

7.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

En Ansible, se ha descubierto que las variables de inventario se cargan desde el directorio de trabajo actual cuando se ejecutan comandos ad-hoc bajo el control del atacante, lo que permite la ejecución de código arbitrario como resultado.

The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. Issues addressed include a code execution vulnerability.

*Credits: N/A

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-05-09 CVE Reserved
2018-07-02 CVE Published
2024-08-05 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation
CWE-426: Untrusted Search Path

CAPEC

References (13)

URL	Tag	Source
http://www.securitytracker.com/id/1041396	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://access.redhat.com/errata/RHBA-2018:3788	2023-02-13
https://access.redhat.com/errata/RHSA-2018:2150	2023-02-13
https://access.redhat.com/errata/RHSA-2018:2151	2023-02-13
https://access.redhat.com/errata/RHSA-2018:2152	2023-02-13
https://access.redhat.com/errata/RHSA-2018:2166	2023-02-13
https://access.redhat.com/errata/RHSA-2018:2321	2023-02-13
https://access.redhat.com/errata/RHSA-2018:2585	2023-02-13
https://access.redhat.com/errata/RHSA-2019:0054	2023-02-13
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874	2023-02-13
https://usn.ubuntu.com/4072-1	2023-02-13
https://access.redhat.com/security/cve/CVE-2018-10874	2019-01-16
https://bugzilla.redhat.com/show_bug.cgi?id=1596528	2019-01-16

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"		Ansible Engine Search vendor "Redhat" for product "Ansible Engine"				2.0 Search vendor "Redhat" for product "Ansible Engine" and version "2.0"		-		Affected
Redhat Search vendor "Redhat"		Ansible Engine Search vendor "Redhat" for product "Ansible Engine"				2.4 Search vendor "Redhat" for product "Ansible Engine" and version "2.4"		-		Affected
Redhat Search vendor "Redhat"		Ansible Engine Search vendor "Redhat" for product "Ansible Engine"				2.5 Search vendor "Redhat" for product "Ansible Engine" and version "2.5"		-		Affected
Redhat Search vendor "Redhat"		Ansible Engine Search vendor "Redhat" for product "Ansible Engine"				2.6 Search vendor "Redhat" for product "Ansible Engine" and version "2.6"		-		Affected
Redhat Search vendor "Redhat"		Openstack Search vendor "Redhat" for product "Openstack"				10 Search vendor "Redhat" for product "Openstack" and version "10"		-		Affected
Redhat Search vendor "Redhat"		Openstack Search vendor "Redhat" for product "Openstack"				12 Search vendor "Redhat" for product "Openstack" and version "12"		-		Affected
Redhat Search vendor "Redhat"		Openstack Search vendor "Redhat" for product "Openstack"				13 Search vendor "Redhat" for product "Openstack" and version "13"		-		Affected
Redhat Search vendor "Redhat"		Virtualization Search vendor "Redhat" for product "Virtualization"				4.0 Search vendor "Redhat" for product "Virtualization" and version "4.0"		-		Affected
Redhat Search vendor "Redhat"		Virtualization Host Search vendor "Redhat" for product "Virtualization Host"				4.0 Search vendor "Redhat" for product "Virtualization Host" and version "4.0"		-		Affected