Red Hat Ansible
29 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2020-14332 | 2.9.12 ; 2.8.14 | A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sens | MEDIUM 5.5 | 0.4 % | ||
| CVE-2020-14330 | 2.10.0 | An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content a | MEDIUM 5.5 | 0.6 % | ||
| CVE-2020-10744 | ansible-engine 2.7.18 and prior ; ansible-engine 2.8.12 and prior ; ansible-engine 2.9.9 and prior ; … | An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become | MEDIUM 5.0 | 0.3 % | ||
| CVE-2020-1746 | ansible-engine versions 2.7.x before 2.7.17 ; ansible-engine versions 2.8.x before 2.8.11 ; ansible-engine versions 2.9.x before 2.9.7 ; … | A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 | MEDIUM 5.0 | 0.4 % | ||
| CVE-2020-10685 | ansible-engine versions 2.7.x before 2.7.17 ; ansible-engine 2.8.x before 2.8.11 ; ansible-engine 2.9.x before 2.9.7 ; … | A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as w | MEDIUM 5.5 | 0.4 % | ||
| CVE-2020-10691 | all ansible-engine versions 2.9.x prior to 2.9.7 | An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. Whe | MEDIUM 5.2 | 0.3 % | ||
| CVE-2019-14905 | 2.9.x before 2.9.3 ; 2.8.x before 2.8.8 ; 2.7.x before 2.7.16 ; … | A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansib | HIGH 7.3 | 0.7 % | ||
| CVE-2020-10684 | all Ansible 2.7.x versions prior to 2.7.17 ; all Ansible 2.8.x versions prior to 2.8.9 ; all Ansible 2.9.x versions prior to 2.9.6 | A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_fa | HIGH 7.9 | 0.3 % | ||
| CVE-2020-1738 | 2.7.x, 2.8.x, 2.9.x | A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task i | LOW 3.9 | 0.4 % | ||
| CVE-2020-1740 | 2.7.x, 2.8.x, 2.9.x | A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another | MEDIUM 4.7 | 0.4 % | ||
| CVE-2020-1735 | 2.7.x, 2.8.x, 2.9.x | A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then ch | MEDIUM 4.6 | 0.5 % | ||
| CVE-2020-1736 | 2.7.x, 2.8.x, 2.9.x | A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the dest | LOW 3.3 | 0.4 % | ||
| CVE-2020-1753 | all Ansible 2.7.x versions prior to 2.7.17 ; all Ansible 2.8.x versions prior to 2.8.11 ; all Ansible 2.9.x versions prior to 2.9.7 | A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all | MEDIUM 5.5 | 0.5 % | ||
| CVE-2020-1739 | 2.7.16 and prior ; 2.8.8 and prior ; 2.9.5 and prior | A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of sv | LOW 3.9 | 0.4 % | ||
| CVE-2020-1733 | 2.7.17 and prior ; 2.8.9 and prior ; 2.9.6 and prior | A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivi | MEDIUM 5.0 | 0.4 % | ||
| CVE-2020-1737 | 2.7.17 and prior ; 2.8.9 and prior ; 2.9.6 and prior ; … | A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip mo | HIGH 7.8 | 0.4 % | ||
| CVE-2020-1734 | n/a | A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() wi | HIGH 7.4 | 0.5 % | ||
| CVE-2019-14864 | Ansible versions 2.9.x before 2.9.1 ; Ansible versions 2.8.x before 2.8.7 ; Ansible versions 2.7.x before 2.7.15 | Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no_log set it | MEDIUM 6.5 | 1.9 % | ||
| CVE-2019-10217 | ansible 2.8.0 before 2.8.4 | A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields | MEDIUM 6.5 | 1.9 % | ||
| CVE-2019-10206 | all 2.8.x before 2.8.4 ; all 2.7.x before 2.7.13 ; all 2.6.x before 2.6.19 | ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt pass | MEDIUM 6.5 | 1.5 % | ||
| CVE-2019-14858 | ansible_engine-2.x up to 2.8 ; ansible_tower-3.x up to 3.5 | A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. When a module has an argument_spec with sub param | HIGH 7.3 | 0.4 % | ||
| CVE-2019-14846 | all ansible_engine-2.x and ansible_engine-3.x up to ansible_engine-3.5 | In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG | HIGH 7.8 | 0.5 % | ||
| CVE-2019-10156 | fixed in 2.6.18 ; fixed in 2.7.12 ; fixed in 2.8.2 | A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of | MEDIUM 5.4 | 1.8 % | ||
| CVE-2019-3828 | 2.5.15 ; 2.6.14 ; 2.7.8 | Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files out | MEDIUM 4.2 | 0.5 % | ||
| CVE-2018-16876 | before 2.5.14 ; before 2.6.11 ; before 2.7.5 | ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to le | MEDIUM 5.3 | 2.5 % | ||
| CVE-2018-16859 | 2.8 and older | Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become' pa | MEDIUM 4.4 | 0.5 % | ||
| CVE-2016-8614 | 2.2.0 | A flaw was found in Ansible before version 2.2.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to | HIGH 7.5 | 2.5 % | ||
| CVE-2016-8628 | 2.2.0 | Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to cre | CRITICAL 9.1 | 3.2 % | ||
| CVE-2016-8647 | 2.2.1.0 | An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in | MEDIUM 4.9 | 1.4 % |