CVE-2016-9587 Ansible is vulnerable to an improper input validation in Ansible's handling of data sent from client systems
HighCVSS 8.1
EPSS 17.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi ansible(PyPI) | < 2.1.4.0 | 2.1.4.0 |
| pypi ansible(PyPI) | = 1.0 | No fix listed |
| pypi ansible(PyPI) | = 1.1 | No fix listed |
| pypi ansible(PyPI) | = 1.2 | No fix listed |
| pypi ansible(PyPI) | = 1.2.1 | No fix listed |
| pypi ansible(PyPI) | = 1.2.2 | No fix listed |
| pypi ansible(PyPI) | = 1.2.3 | No fix listed |
| pypi ansible(PyPI) | = 1.3.0 | No fix listed |
| pypi ansible(PyPI) | = 1.3.1 | No fix listed |
| pypi ansible(PyPI) | = 1.3.2 | No fix listed |
| pypi ansible(PyPI) | = 1.3.3 | No fix listed |
| pypi ansible(PyPI) | = 1.3.4 | No fix listed |
| pypi ansible(PyPI) | = 1.4 | No fix listed |
| pypi ansible(PyPI) | = 1.4.1 | No fix listed |
| pypi ansible(PyPI) | = 1.4.2 | No fix listed |
| pypi ansible(PyPI) | = 1.4.3 | No fix listed |
| pypi ansible(PyPI) | = 1.4.4 | No fix listed |
| pypi ansible(PyPI) | = 1.4.5 | No fix listed |
| pypi ansible(PyPI) | = 1.5 | No fix listed |
| pypi ansible(PyPI) | = 1.5.1 | No fix listed |
| pypi ansible(PyPI) | = 1.5.2 | No fix listed |
| pypi ansible(PyPI) | = 1.5.3 | No fix listed |
| pypi ansible(PyPI) | = 1.5.4 | No fix listed |
| pypi ansible(PyPI) | = 1.5.5 | No fix listed |
| pypi ansible(PyPI) | = 1.6 | No fix listed |
Show 47 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi ansible(PyPI) | = 1.6.1 | No fix listed |
| pypi ansible(PyPI) | = 1.6.10 | No fix listed |
| pypi ansible(PyPI) | = 1.6.2 | No fix listed |
| pypi ansible(PyPI) | = 1.6.3 | No fix listed |
| pypi ansible(PyPI) | = 1.6.4 | No fix listed |
| pypi ansible(PyPI) | = 1.6.5 | No fix listed |
| pypi ansible(PyPI) | = 1.6.6 | No fix listed |
| pypi ansible(PyPI) | = 1.6.7 | No fix listed |
| pypi ansible(PyPI) | = 1.6.8 | No fix listed |
| pypi ansible(PyPI) | = 1.6.9 | No fix listed |
| pypi ansible(PyPI) | = 1.7 | No fix listed |
| pypi ansible(PyPI) | = 1.7.1 | No fix listed |
| pypi ansible(PyPI) | = 1.7.2 | No fix listed |
| pypi ansible(PyPI) | = 1.8 | No fix listed |
| pypi ansible(PyPI) | = 1.8.1 | No fix listed |
| pypi ansible(PyPI) | = 1.8.2 | No fix listed |
| pypi ansible(PyPI) | = 1.8.3 | No fix listed |
| pypi ansible(PyPI) | = 1.8.4 | No fix listed |
| pypi ansible(PyPI) | = 1.9.0 | No fix listed |
| pypi ansible(PyPI) | = 1.9.0.1 | No fix listed |
| pypi ansible(PyPI) | = 1.9.1 | No fix listed |
| pypi ansible(PyPI) | = 1.9.2 | No fix listed |
| pypi ansible(PyPI) | = 1.9.3 | No fix listed |
| pypi ansible(PyPI) | = 1.9.4 | No fix listed |
| pypi ansible(PyPI) | = 1.9.5 | No fix listed |
| pypi ansible(PyPI) | = 1.9.6 | No fix listed |
| pypi ansible(PyPI) | = 2.0.0 | No fix listed |
| pypi ansible(PyPI) | = 2.0.0.0 | No fix listed |
| pypi ansible(PyPI) | = 2.0.0.1 | No fix listed |
| pypi ansible(PyPI) | = 2.0.0.2 | No fix listed |
| pypi ansible(PyPI) | = 2.0.1.0 | No fix listed |
| pypi ansible(PyPI) | = 2.0.2.0 | No fix listed |
| pypi ansible(PyPI) | = 2.1.0.0 | No fix listed |
| pypi ansible(PyPI) | = 2.1.1.0 | No fix listed |
| pypi ansible(PyPI) | = 2.1.2.0 | No fix listed |
| pypi ansible(PyPI) | = 2.1.3.0 | No fix listed |
| pypi ansible(PyPI) | >= 2.2.0.0, < 2.2.1.0 | 2.2.1.0 |
| pypi ansible(PyPI) | = 2.2.0.0 | No fix listed |
| debian/ansible(Debian:12) | < 2.2.0.0-3 | 2.2.0.0-3 |
| debian/ansible(Debian:13) | < 2.2.0.0-3 | 2.2.0.0-3 |
| debian/ansible(Debian:14) | < 2.2.0.0-3 | 2.2.0.0-3 |
| pypi ansible(PyPI) | <= 2.1.3.0 | No fix listed |
| redhat ansible | < 2.1.4 | 2.1.4 |
| ansible | < 2.2.1 | 2.2.1 |
| redhat openstack | = 11 | No fix listed |
| alpine/ansible(Alpine:v3.4) | < 2.1.4.0-r0 | 2.1.4.0-r0 |
| alpine/ansible(Alpine:v3.5) | < 2.2.1.0-r0 | 2.2.1.0-r0 |
References
- Debian Security Tracker CVE-2016-9587 vendor-advisory
- bugs.debian.org issue-tracking
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2017:0448 third-party-advisory vendor-advisory
- RHSA-2017:0515 third-party-advisory vendor-advisory
- RHSA-2017:1685 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- github.com vendor-advisory
- github.com product
- github.com
- GLSA-201701-77 third-party-advisory vendor-advisory
- web.archive.org
- 41013 exploit third-party-advisory vdb-entry
- RHSA-2017:0195 third-party-advisory vendor-advisory
- RHSA-2017:0260 third-party-advisory vendor-advisory
- 95352 third-party-advisory vdb-entry
- security.alpinelinux.org vendor-advisory