Red Hat Ansible
En bref
- Source
- NVD
- EPSS
- EPSS 2.46 % · centile 84 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.
Faiblesses (CWE)
- CWE-358 — Contrôle de sécurité d'un standard mal implémenté
- CWE-320 — Erreurs de gestion de clés
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 6.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L | redhat |
| CVSS 3.0 | MEDIUM 6.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-cmwx-9m2h-x7v4 — Ansible apt_key module does not properly verify key fingerprint
- PYSEC-2018-37 — A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP k
Références européennes
- ENISA EUVD · EUVD-2018-0010
- GCVE · GCVE-0-2016-8614
Configurations affectées (CPE NVD)
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*< 2.2.0
Produits affectés
| Produit | Versions |
|---|---|
| Red Hat · Ansible | affected 2.2.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |