CVE-2019-14905: Ansible - Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path
Summary
CVE-2019-14905: A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on... Affects ansible across 3 version ranges.
>= 2.7.0a1, < 2.7.16
>= 2.8.0a1, < 2.8.8
>= 2.9.0a1, < 2.9.3
Fixed in 2.7.16, 2.8.8 or 2.9.3, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Alpine:v3.10
The same CVE-2019-14905 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the DevOps community for its simplicity and flexibility. However, Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16, and earlier are vulnerable to an issue in the nxos_file_copy module. This module is used to copy files to a flash or bootflash on NXOS devices. The vulnerability allows for OS command injections by crafting the filename parameter, leading to potential loss of system confidentiality and other security issues.
Vulnerability Detail
The vulnerability in Ansible Engine arises from improper input validation and external control of the file name or path. By manipulating the filename parameter in the nxos_file_copy module, an attacker can inject malicious code into the system. This can result in the execution of arbitrary commands with elevated privileges, potentially compromising the confidentiality of the system. The vulnerability has a CVSS score of 5.6.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.7.0a1, < 2.7.162.7.16pip install --upgrade "ansible==2.7.16" -
>= 2.8.0a1, < 2.8.82.8.8pip install --upgrade "ansible==2.8.8" -
>= 2.9.0a1, < 2.9.32.9.3pip install --upgrade "ansible==2.9.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, users can disable the nxos_file_copy module if it is not essential for their operations. This can be done by modifying the Ansible playbook or configuration to exclude the module from execution. However, this workaround should only be considered temporary, and upgrading to a patched version is the recommended long-term solution.
Conclusion
The vulnerability in Ansible Engine's nxos_file_copy module exposes systems to OS command injections and potential loss of confidentiality. It is crucial for users to upgrade to the latest patched versions (2.7.16, 2.8.8, or 2.9.3 or later) to mitigate this vulnerability. Additionally, reviewing and updating any custom code utilizing the module is recommended. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible Engine is an open-source automation tool used for configuration management, application deployment, and orchestration.
The vulnerability affects Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16, and earlier.
The vulnerability allows for OS command injections, potentially leading to a loss of system confidentiality and other security issues.
To fix this vulnerability, it is recommended to upgrade to the latest version of Ansible Engine (2.7.16, 2.8.8, or 2.9.3 or later).
Yes, users can disable the nxos_file_copy module if it is not necessary for their operations. However, upgrading to a patched version is the recommended long-term solution.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
