logo

Database

Server side template injection In ansible

Description

Ansible fails to properly sanitize fact variables sent from the Ansible controller Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2016-86282. NVD-2016-86283. OSV-2016-86284. OSV-DEBIAN-2016-86285. GHSA-jg4f-jqm5-4mgq6. GCVE-2016-86287. access.redhat.com8. SECURITY-TRACKER-CVE-2016-8628

References

1. https://github.com/ansible/ansible/issues/419032. https://github.com/ansible/ansible/commit/35938b907dfcd1106ca40b794f0db446bdb8cf093. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-86284. https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-38.yaml5. https://web.archive.org/web/20200227214455/http://www.securityfocus.com/bid/94109

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.