Critical OS Command Injection Vulnerability in Ansible Package
Summary
ALPINE-CVE-2019-14905: A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on... Affects ansible versions < 2.8.8-r0. Fixed in 2.8.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that simplifies the management of IT infrastructure. It allows users to automate tasks such as configuration management, application deployment, and orchestration. The tool is widely used for its simplicity and agentless architecture, making it a popular choice among system administrators. However, certain versions of Ansible have been found to contain a vulnerability that could allow malicious actors to execute arbitrary OS commands.
Vulnerability Detail
A vulnerability exists in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, and 2.7.x before 2.7.16, specifically in the nxos_file_copy module. This module can be exploited to copy files to flash or bootflash on NXOS devices. By crafting a malicious filename parameter, an attacker could perform OS command injections, leading to potential data breaches and loss of system confidentiality. The CVSS score for this vulnerability is 5.6, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.8.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade ansibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the nxos_file_copy module until the package is updated. Additionally, ensure that proper input validation is implemented to sanitize filename parameters.
Conclusion
The vulnerability in the Ansible package poses a significant risk due to the potential for OS command injection. Users are strongly advised to update their packages to the latest patched versions to safeguard their systems. Regular monitoring for vulnerabilities, such as through Vulert, can help maintain security in open-source software.
See every vulnerability recorded for ansible →
FAQ
The vulnerability allows for OS command injection through the nxos_file_copy module in Ansible.
Ansible versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, and 2.7.x before 2.7.16 are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability.
The CVSS score for this vulnerability is 5.6, indicating a moderate severity level.
If an immediate update is not possible, refrain from using the nxos_file_copy module and implement input validation to mitigate risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
