CVE-2013-2233: Ansible - Failure to Cache SSH Host Keys
Summary
CVE-2013-2233: Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys. Affects ansible versions < 1.2.1. Fixed in 1.2.1. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2013-2233 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the industry due to its simplicity and flexibility. However, prior to version 1.2.1, Ansible had a vulnerability that made it susceptible to man-in-the-middle attacks. This vulnerability stemmed from the failure to cache SSH host keys, which made it easier for remote attackers to intercept and manipulate communication between Ansible and target systems.
Vulnerability Detail
The vulnerability (CVE-2013-2233) in Ansible allowed remote attackers to conduct man-in-the-middle attacks by exploiting the lack of SSH host key caching. By intercepting the SSH communication between Ansible and target systems, attackers could potentially eavesdrop on sensitive information, modify data, or even impersonate the target system. This vulnerability posed a significant security risk for organizations using Ansible for their automation tasks.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.1
This is the first release that contains the fix.
pip install --upgrade "ansible==1.2.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading Ansible is not immediately feasible, a temporary workaround is to manually cache SSH host keys on the Ansible control machine. This can be done by connecting to each target system using SSH and accepting the host key fingerprint. By doing so, Ansible will have the necessary host keys cached and will be less susceptible to man-in-the-middle attacks. However, this workaround is not recommended as a long-term solution, and upgrading to the latest version is the best course of action.
Conclusion
The vulnerability in Ansible (CVE-2013-2233) allowed for man-in-the-middle attacks due to the failure to cache SSH host keys. Upgrading to version 1.2.1 or later is crucial to mitigate this vulnerability. Users should also consider implementing additional security measures to enhance the overall security of their Ansible installations. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
This vulnerability allows remote attackers to intercept and manipulate communication between Ansible and target systems, potentially leading to unauthorized access, data leakage, or system compromise.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Ansible installation is affected by this vulnerability. Simply upload your Pipfile.lock and the playground will analyze it for any known vulnerabilities.
While there are no publicly known exploits for this specific vulnerability, it is important to promptly apply the recommended fix to mitigate any potential risks.
In addition to upgrading Ansible and caching SSH host keys, it is recommended to follow security best practices such as using strong SSH key pairs, regularly monitoring system logs for suspicious activity, and implementing network segmentation to limit the impact of a potential attack.
You can find more information about this vulnerability, including technical details and the fix, in the Ansible advisory database: https://github.com/pypa/advisory-database/blob/main/vulns/ansible/PYSEC-2018-36.yaml
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
