CVE-2013-4259: Vulnerability in Ansible
Summary
CVE-2013-4259: runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/. Affects ansible versions < 1.2.3. Fixed in 1.2.3. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2013-4259 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate tasks such as configuration management, application deployment, and orchestration. It is widely used in IT infrastructure management and provides a simple and agentless approach to automate complex tasks. However, a vulnerability has been identified in Ansible versions prior to 1.2.3.
Vulnerability Detail
The vulnerability (CVE-2013-4259) exists in the 'runner/connection_plugins/ssh.py' file of Ansible. When using ControlPersist, local users can exploit a symlink attack on a socket file with a predictable name in the '/tmp/' directory. This allows the attacker to redirect an SSH session and potentially gain unauthorized access or perform malicious actions on the target system.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.2.3
This is the first release that contains the fix.
pip install --upgrade "ansible==1.2.3"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that the '/tmp/' directory is properly secured and restricting access to sensitive files and directories.
Conclusion
The vulnerability in Ansible (CVE-2013-4259) allows local users to redirect SSH sessions and potentially gain unauthorized access or perform malicious actions. It is crucial to upgrade Ansible to version 1.2.3 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
The vulnerability allows local users to redirect SSH sessions and potentially gain unauthorized access or perform malicious actions on the target system.
Versions of Ansible prior to 1.2.3 are affected by this vulnerability.
Yes, upgrading Ansible to version 1.2.3 or later fixes this vulnerability.
While there is no specific workaround mentioned, securing the '/tmp/' directory and restricting access to sensitive files can help mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
