SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityModified

CVE-2016-8628

An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.

CRITICAL 9.1EPSS 3.25%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.25%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.

CVSS 3.0
9.1 CRITICALCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS
3.25% probability · 88th percentile
CISA KEV
Not listed
Weakness
CWE-77
Affected
redhat/ansible
Source
secalert@redhat.com

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.