CVE-2014-3498
Published: 8 June 2017
The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.
From the Ubuntu Security Team
It was discovered that Ansible improperly handled the output of certain commands. An attacker could use this vulnerability to execute arbitrary commands on the ansible manging host.
Priority
Status
Package | Release | Status |
---|---|---|
ansible Launchpad, Ubuntu, Debian |
artful |
Not vulnerable
|
bionic |
Not vulnerable
|
|
cosmic |
Not vulnerable
|
|
disco |
Not vulnerable
|
|
eoan |
Not vulnerable
|
|
focal |
Not vulnerable
|
|
hirsute |
Not vulnerable
|
|
precise |
Does not exist
|
|
trusty |
Released
(1.5.4+dfsg-1ubuntu0.1~esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
upstream |
Released
(1.7.0+dfsg-1)
|
|
wily |
Not vulnerable
(1.9.2+dfsg-2)
|
|
xenial |
Not vulnerable
|
|
yakkety |
Not vulnerable
|
|
zesty |
Not vulnerable
|
|
groovy |
Not vulnerable
|
|
impish |
Not vulnerable
|
|
jammy |
Not vulnerable
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 8.8 |
Attack vector | Network |
Attack complexity | Low |
Privileges required | Low |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |