Candidate: CVE-2017-7466
PublicDate: 2018-06-22 13:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7466
 https://github.com/ansible/ansible/commit/0d418789a298561fded9bce977d34babc9097079 (v2.3.0.0-0.1.rc1)
 http://www.securityfocus.com/bid/97595
Description:
 Ansible before version 2.3 has an input validation vulnerability in the
 handling of data sent from client systems. An attacker with control over a
 client system being managed by Ansible, and the ability to send facts back
 to the Ansible server, could use this flaw to execute arbitrary code on the
 Ansible server using the Ansible server privileges.
Ubuntu-Description:
Notes:
 msalvatore> This CVE identifies an incompete fix for CVE-2016-9587
Bugs:
Priority: medium
Discovered-by: Evgeni Golov
Assigned-to: mikesalvatore
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H [8.0 HIGH]

Patches_ansible:
upstream_ansible: released (2.2.1.0-2)
precise_ansible: DNE
precise/esm_ansible: DNE
trusty_ansible: not-affected (code not present)
trusty/esm_ansible: not-affected (code not present)
vivid/stable-phone-overlay_ansible: DNE
vivid/ubuntu-core_ansible: DNE
xenial_ansible: released (2.0.0.2-2ubuntu1.1)

yakkety_ansible: ignored (reached end-of-life)
zesty_ansible: ignored (reached end-of-life)
artful_ansible: ignored (reached end-of-life)
bionic_ansible: not-affected (2.5.1+dfsg-1)
devel_ansible: not-affected (2.6.1+dfsg-1)