Rapid7 Vulnerability & Exploit Database

Red Hat OpenShift: CVE-2016-8628: ansible: Command injection by compromised server via fact variables

Back to Search

Red Hat OpenShift: CVE-2016-8628: ansible: Command injection by compromised server via fact variables

Severity
9
CVSS
(AV:N/AC:L/Au:S/C:C/I:C/A:C)
Published
06/18/2018
Created
07/25/2018
Added
06/18/2018
Modified
10/15/2018

Description

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.

Solution(s)

  • linuxrpm-upgrade-ansible

References

  • linuxrpm-upgrade-ansible

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;