CVE-2019-14904: Solaris Zone Arbitrary Command Execution in Ansible
Summary
CVE-2019-14904: A flaw was found in the solaris_zone module from the Ansible Community modules. Affects ansible across 3 version ranges.
< 2.7.15
>= 2.8.0, < 2.8.7
>= 2.9.0, < 2.9.2
Fixed in 2.7.15, 2.8.7 or 2.9.2, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Alpine:v3.10
The same CVE-2019-14904 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It uses a declarative language to describe system configurations and relies on SSH for communication with remote systems. The solaris_zone module is a part of the Ansible Community modules and is used for managing Solaris zones, which are isolated virtual environments within a Solaris operating system. This module allows users to create, delete, and manage zones on Solaris hosts.
Vulnerability Detail
The solaris_zone module in Ansible versions 2.7.15, 2.8.7, and 2.9.2 and previous versions is vulnerable to arbitrary command execution. When setting the name for a zone on a Solaris host, the module uses the 'ps' command to list processes on the remote machine. However, the module does not properly sanitize user input, allowing an attacker to craft a malicious zone name that includes arbitrary commands. These commands will be executed on the remote host with the privileges of the Ansible user, potentially leading to unauthorized access, data leakage, or further compromise of the system.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.7.152.7.15pip install --upgrade "ansible==2.7.15" -
>= 2.8.0, < 2.8.72.8.7pip install --upgrade "ansible==2.8.7" -
>= 2.9.0, < 2.9.22.9.2pip install --upgrade "ansible==2.9.2"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can avoid using the solaris_zone module or disable the affected functionality in their Ansible playbooks. This can be done by excluding tasks that involve zone creation or management on Solaris hosts. However, this workaround may limit the functionality of Ansible in managing Solaris zones.
Conclusion
The solaris_zone module in Ansible versions 2.7.15, 2.8.7, and 2.9.2 and previous versions is vulnerable to arbitrary command execution. Users should upgrade to a fixed version of Ansible to mitigate this vulnerability. As a temporary workaround, users can avoid using the solaris_zone module or disable the affected functionality in their Ansible playbooks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
The solaris_zone module is a part of the Ansible Community modules and is used for managing Solaris zones on Solaris hosts.
This vulnerability allows an attacker to execute arbitrary commands on a remote Solaris host with the privileges of the Ansible user, potentially leading to unauthorized access, data leakage, or further compromise of the system.
To fix this vulnerability, users should upgrade to a fixed version of Ansible (2.7.15, 2.8.7, or 2.9.2).
As a temporary workaround, users can avoid using the solaris_zone module or disable the affected functionality in their Ansible playbooks.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
