p PatchFirst

CVE-2024-9902

CVE-2024-9902 · Ansible-core: ansible-core user may read/write unauthorized content

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.

CVSS 6.3 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • ansible automation platform execution environments

    Versions
    • ≥ 3.0.1-96: Not affected (rpm)

    No fix published

  • ansible automation platform execution environments

    Versions
    • ≥ 3.0.1-95: Not affected (rpm)

    No fix published

  • ansible automation platform execution environments

    Versions
    • ≥ 2.9.27-32: Not affected (rpm)

    No fix published

  • ansible automation platform execution environments

    Versions
    • ≥ 2.14.13-21: Not affected (rpm)

    No fix published

  • ansible automation platform execution environments

    Versions
    • ≥ 2.17.6-2: Not affected (rpm)

    No fix published

  • red hat ansible automation platform 2.4 for rhel 8

    Versions
    • ≥ 1:2.15.13-1.el8ap: Not affected (rpm)

    No fix published

  • red hat ansible automation platform 2.4 for rhel 9

    Versions
    • ≥ 1:2.15.13-1.el9ap: Not affected (rpm)

    No fix published

  • red hat ansible automation platform 2.5 for rhel 8

    Versions
    • ≥ 1:2.16.13-1.el8ap: Not affected (rpm)

    No fix published

  • red hat ansible automation platform 2.5 for rhel 9

    Versions
    • ≥ 1:2.16.13-1.el9ap: Not affected (rpm)

    No fix published

  • red hat openstack platform 17.1 for rhel 9

    Versions
    • ≥ 0:2.14.2-4.6.el9ost: Not affected (rpm)

    No fix published

  • red hat enterprise linux 10

    No fix published

  • ansible Debian:12

    Affected ranges
    • ECOSYSTEM: < 5.4.0-1

    Update to 5.4.0-1

  • ansible Debian:13

    Affected ranges
    • ECOSYSTEM: < 5.4.0-1

    Update to 5.4.0-1

  • ansible Debian:14

    Affected ranges
    • ECOSYSTEM: < 5.4.0-1

    Update to 5.4.0-1

  • ansible-core Debian:12

    Versions
    • 2.14.10-1
    • 2.14.11-1
    • 2.14.11-2
    • 2.14.13-1
    • 2.14.16-0+deb12u1
    • 2.14.3-1
    • 2.14.6-1
    • 2.14.7-1
    • 2.14.8-1
    • 2.14.9-1
    • 2.14.9-2
    Affected ranges
    • ECOSYSTEM: < 2.14.18-0+deb12u1

    Update to 2.14.18-0+deb12u1

  • ansible-core Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.18.0-1

    Update to 2.18.0-1

  • ansible-core Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.18.0-1

    Update to 2.18.0-1

  • ansible-core PyPI

    Versions
    • 0.0.1a1
    • 2.11.0
    • 2.11.0b1
    • 2.11.0b2
    • 2.11.0b3
    • 2.11.0b4
    • 2.11.0rc1
    • 2.11.0rc2
    • 2.11.1
    • 2.11.10
    • 2.11.10rc1
    • 2.11.11
    • 2.11.11rc1
    • 2.11.12
    • 2.11.12rc1
    • 2.11.1rc1
    • 2.11.2
    • 2.11.2rc1
    • 2.11.3
    • 2.11.3rc1
    • 2.11.4
    • 2.11.4rc1
    • 2.11.5
    • 2.11.5rc1
    • 2.11.6
    • 2.11.6rc1
    • 2.11.7
    • 2.11.7rc1
    • 2.11.8
    • 2.11.8rc1
    • 2.11.9
    • 2.11.9rc1
    • 2.12.0
    • 2.12.0b1
    • 2.12.0b2
    • 2.12.0rc1
    • 2.12.1
    • 2.12.10
    • 2.12.10rc1
    • 2.12.1rc1
    • 2.12.2
    • 2.12.2rc1
    • 2.12.3
    • 2.12.3rc1
    • 2.12.4
    • 2.12.4rc1
    • 2.12.5
    • 2.12.5rc1
    • 2.12.6
    • 2.12.6rc1
    • 2.12.7
    • 2.12.7rc1
    • 2.12.8
    • 2.12.8rc1
    • 2.12.9
    • 2.12.9rc1
    • 2.13.0
    • 2.13.0b0
    • 2.13.0b1
    • 2.13.0rc1
    • 2.13.1
    • 2.13.10
    • 2.13.10rc1
    • 2.13.11
    • 2.13.11rc1
    • 2.13.12
    • 2.13.12rc1
    • 2.13.13
    • 2.13.13rc1
    • 2.13.1rc1
    • 2.13.2
    • 2.13.2rc1
    • 2.13.3
    • 2.13.3rc1
    • 2.13.4
    • 2.13.4rc1
    • 2.13.5
    • 2.13.5rc1
    • 2.13.6
    • 2.13.6rc1
    • 2.13.7
    • 2.13.7rc1
    • 2.13.8
    • 2.13.8rc1
    • 2.13.9
    • 2.13.9rc1
    • 2.14.0
    • 2.14.0b1
    • 2.14.0b2
    • 2.14.0b3
    • 2.14.0rc1
    • 2.14.0rc1.post0
    • 2.14.0rc2
    • 2.14.1
    • 2.14.10
    • 2.14.10rc1
    • 2.14.11
    • 2.14.11rc1
    • 2.14.12
    • 2.14.12rc1
    • 2.14.13
    • 2.14.14
    • 2.14.14rc1
    • 2.14.15
    • 2.14.15rc1
    • 2.14.16
    • 2.14.16rc1
    • 2.14.17
    • 2.14.17rc1
    • 2.14.1rc1
    • 2.14.2
    • 2.14.2rc1
    • 2.14.3
    • 2.14.3rc1
    • 2.14.4
    • 2.14.4rc1
    • 2.14.5
    • 2.14.5rc1
    • 2.14.6
    • 2.14.6rc1
    • 2.14.7
    • 2.14.7rc1
    • 2.14.8
    • 2.14.8rc1
    • 2.14.9
    • 2.14.9rc1
    Affected ranges
    • ECOSYSTEM: < 2.14.18rc1

    Update to 2.14.18rc1

  • ansible-core PyPI

    Versions
    • 2.15.0
    • 2.15.0b1
    • 2.15.0b2
    • 2.15.0b3
    • 2.15.0rc1
    • 2.15.0rc2
    • 2.15.1
    • 2.15.10
    • 2.15.10rc1
    • 2.15.11
    • 2.15.11rc1
    • 2.15.12
    • 2.15.12rc1
    • 2.15.1rc1
    • 2.15.2
    • 2.15.2rc1
    • 2.15.3
    • 2.15.3rc1
    • 2.15.4
    • 2.15.4rc1
    • 2.15.5
    • 2.15.5rc1
    • 2.15.6
    • 2.15.6rc1
    • 2.15.7
    • 2.15.7rc1
    • 2.15.8
    • 2.15.9
    • 2.15.9rc1
    Affected ranges
    • ECOSYSTEM: ≥ 2.15.0b1, < 2.15.13rc1

    Update to 2.15.13rc1

  • ansible-core PyPI

    Versions
    • 2.16.0
    • 2.16.0b1
    • 2.16.0b2
    • 2.16.0rc1
    • 2.16.1
    • 2.16.10
    • 2.16.10rc1
    • 2.16.11
    • 2.16.11rc1
    • 2.16.12
    • 2.16.12rc1
    • 2.16.1rc1
    • 2.16.2
    • 2.16.3
    • 2.16.3rc1
    • 2.16.4
    • 2.16.4rc1
    • 2.16.5
    • 2.16.5rc1
    • 2.16.6
    • 2.16.7
    • 2.16.7rc1
    • 2.16.8
    • 2.16.8rc1
    • 2.16.9
    • 2.16.9rc1
    Affected ranges
    • ECOSYSTEM: ≥ 2.16.0b1, < 2.16.13rc1

    Update to 2.16.13rc1

  • ansible-core PyPI

    Versions
    • 2.17.0
    • 2.17.0b1
    • 2.17.0rc1
    • 2.17.0rc2
    • 2.17.1
    • 2.17.1rc1
    • 2.17.2
    • 2.17.2rc1
    • 2.17.2rc2
    • 2.17.3
    • 2.17.3rc1
    • 2.17.4
    • 2.17.4rc1
    • 2.17.5
    • 2.17.5rc1
    Affected ranges
    • ECOSYSTEM: ≥ 2.17.0b1, < 2.17.6rc1

    Update to 2.17.6rc1

  • ansible-core PyPI

    Versions
    • 2.18.0b1
    • 2.18.0rc1
    Affected ranges
    • ECOSYSTEM: ≥ 2.18.0b1, < 2.18.0rc2

    Update to 2.18.0rc2

  • ansible-core PyPI

    Versions
    • 0.0.1a1
    • 2.11.0
    • 2.11.0b1
    • 2.11.0b2
    • 2.11.0b3
    • 2.11.0b4
    • 2.11.0rc1
    • 2.11.0rc2
    • 2.11.1
    • 2.11.10
    • 2.11.10rc1
    • 2.11.11
    • 2.11.11rc1
    • 2.11.12
    • 2.11.12rc1
    • 2.11.1rc1
    • 2.11.2
    • 2.11.2rc1
    • 2.11.3
    • 2.11.3rc1
    • 2.11.4
    • 2.11.4rc1
    • 2.11.5
    • 2.11.5rc1
    • 2.11.6
    • 2.11.6rc1
    • 2.11.7
    • 2.11.7rc1
    • 2.11.8
    • 2.11.8rc1
    • 2.11.9
    • 2.11.9rc1
    • 2.12.0
    • 2.12.0b1
    • 2.12.0b2
    • 2.12.0rc1
    • 2.12.1
    • 2.12.10
    • 2.12.10rc1
    • 2.12.1rc1
    • 2.12.2
    • 2.12.2rc1
    • 2.12.3
    • 2.12.3rc1
    • 2.12.4
    • 2.12.4rc1
    • 2.12.5
    • 2.12.5rc1
    • 2.12.6
    • 2.12.6rc1
    • 2.12.7
    • 2.12.7rc1
    • 2.12.8
    • 2.12.8rc1
    • 2.12.9
    • 2.12.9rc1
    • 2.13.0
    • 2.13.0b0
    • 2.13.0b1
    • 2.13.0rc1
    • 2.13.1
    • 2.13.10
    • 2.13.10rc1
    • 2.13.11
    • 2.13.11rc1
    • 2.13.12
    • 2.13.12rc1
    • 2.13.13
    • 2.13.13rc1
    • 2.13.1rc1
    • 2.13.2
    • 2.13.2rc1
    • 2.13.3
    • 2.13.3rc1
    • 2.13.4
    • 2.13.4rc1
    • 2.13.5
    • 2.13.5rc1
    • 2.13.6
    • 2.13.6rc1
    • 2.13.7
    • 2.13.7rc1
    • 2.13.8
    • 2.13.8rc1
    • 2.13.9
    • 2.13.9rc1
    • 2.14.0
    • 2.14.0b1
    • 2.14.0b2
    • 2.14.0b3
    • 2.14.0rc1
    • 2.14.0rc1.post0
    • 2.14.0rc2
    • 2.14.1
    • 2.14.10
    • 2.14.10rc1
    • 2.14.11
    • 2.14.11rc1
    • 2.14.12
    • 2.14.12rc1
    • 2.14.13
    • 2.14.14
    • 2.14.14rc1
    • 2.14.15
    • 2.14.15rc1
    • 2.14.16
    • 2.14.16rc1
    • 2.14.17
    • 2.14.17rc1
    • 2.14.1rc1
    • 2.14.2
    • 2.14.2rc1
    • 2.14.3
    • 2.14.3rc1
    • 2.14.4
    • 2.14.4rc1
    • 2.14.5
    • 2.14.5rc1
    • 2.14.6
    • 2.14.6rc1
    • 2.14.7
    • 2.14.7rc1
    • 2.14.8
    • 2.14.8rc1
    • 2.14.9
    • 2.14.9rc1
    • 2.15.0
    • 2.15.0b1
    • 2.15.0b2
    • 2.15.0b3
    • 2.15.0rc1
    • 2.15.0rc2
    • 2.15.1
    • 2.15.10
    • 2.15.10rc1
    • 2.15.11
    • 2.15.11rc1
    • 2.15.12
    • 2.15.12rc1
    • 2.15.1rc1
    • 2.15.2
    • 2.15.2rc1
    • 2.15.3
    • 2.15.3rc1
    • 2.15.4
    • 2.15.4rc1
    • 2.15.5
    • 2.15.5rc1
    • 2.15.6
    • 2.15.6rc1
    • 2.15.7
    • 2.15.7rc1
    • 2.15.8
    • 2.15.9
    • 2.15.9rc1
    • 2.16.0
    • 2.16.0b1
    • 2.16.0b2
    • 2.16.0rc1
    • 2.16.1
    • 2.16.10
    • 2.16.10rc1
    • 2.16.11
    • 2.16.11rc1
    • 2.16.12
    • 2.16.12rc1
    • 2.16.1rc1
    • 2.16.2
    • 2.16.3
    • 2.16.3rc1
    • 2.16.4
    • 2.16.4rc1
    • 2.16.5
    • 2.16.5rc1
    • 2.16.6
    • 2.16.7
    • 2.16.7rc1
    • 2.16.8
    • 2.16.8rc1
    • 2.16.9
    • 2.16.9rc1
    • 2.17.0
    • 2.17.0b1
    • 2.17.0rc1
    • 2.17.0rc2
    • 2.17.1
    • 2.17.1rc1
    • 2.17.2
    • 2.17.2rc1
    • 2.17.2rc2
    • 2.17.3
    • 2.17.3rc1
    • 2.17.4
    • 2.17.4rc1
    • 2.17.5
    • 2.17.5rc1
    • 2.18.0b1
    • 2.18.0rc1
    Affected ranges
    • ECOSYSTEM: < 2.14.18rc1 ∪ ≥ 2.15.0b1, < 2.15.13rc1 ∪ ≥ 2.16.0b1, < 2.16.13rc1 ∪ ≥ 2.17.0b1, < 2.17.6rc1 ∪ ≥ 2.18.0b1, < 2.18.0rc2

    Update to 2.14.18rc1; Update to 2.15.13rc1; Update to 2.16.13rc1; Update to 2.17.6rc1; Update to 2.18.0rc2

  • ansible Ubuntu:Pro:14.04:LTS

    Versions
    • 1.1+dfsg-1
    • 1.3.4+dfsg-1
    • 1.4.0+dfsg-1
    • 1.4.1+dfsg-1
    • 1.4.3+dfsg-1
    • 1.4.4+dfsg-1
    • 1.5.4+dfsg-1
    • 1.5.4+dfsg-1ubuntu0.1~esm1
    • 1.5.4+dfsg-1ubuntu0.1~esm2
    • 1.5.4+dfsg-1ubuntu0.1~esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →