p PatchFirst

CVE-2016-8628

CVE-2016-8628

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.

CVSS 7.6 · High · EPSS 3.2% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • ansible

    Versions
    • 2.2.0: Affected

    No fix published

  • ansible Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.2.0.0-1

    Update to 2.2.0.0-1

  • ansible Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.2.0.0-1

    Update to 2.2.0.0-1

  • ansible Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.2.0.0-1

    Update to 2.2.0.0-1

  • ansible PyPI

    Versions
    • 1.0
    • 1.1
    • 1.2
    • 1.2.1
    • 1.2.2
    • 1.2.3
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.3.3
    • 1.3.4
    • 1.4
    • 1.4.1
    • 1.4.2
    • 1.4.3
    • 1.4.4
    • 1.4.5
    • 1.5
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.5.4
    • 1.5.5
    • 1.6
    • 1.6.1
    • 1.6.10
    • 1.6.2
    • 1.6.3
    • 1.6.4
    • 1.6.5
    • 1.6.6
    • 1.6.7
    • 1.6.8
    • 1.6.9
    • 1.7
    • 1.7.1
    • 1.7.2
    • 1.8
    • 1.8.1
    • 1.8.2
    • 1.8.3
    • 1.8.4
    • 1.9.0
    • 1.9.0.1
    • 1.9.1
    • 1.9.2
    • 1.9.3
    • 1.9.4
    • 1.9.5
    • 1.9.6
    • 2.0.0
    • 2.0.0.0
    • 2.0.0.1
    • 2.0.0.2
    • 2.0.1.0
    • 2.0.2.0
    • 2.1.0.0
    • 2.1.1.0
    • 2.1.2.0
    • 2.1.3.0
    • 2.1.4.0
    • 2.1.5.0
    • 2.1.6.0
    Affected ranges
    • ECOSYSTEM: < 2.2.0.0

    Update to 2.2.0.0

  • ansible Ubuntu:16.04:LTS

    Versions
    • 1.9.2+dfsg-2
    • 1.9.4-1
    • 2.0.0.2-2
    • 2.0.0.2-2ubuntu1
    Affected ranges
    • ECOSYSTEM: < 2.0.0.2-2ubuntu1.1

    Update to 2.0.0.2-2ubuntu1.1

Original sources

Check your server →