logo

Database

Insecure deserialization In ansible

Description

Ansible apt_key module does not properly verify key fingerprint A flaw was found in Ansible before version 2.2.0.0. The apt_key module does not properly verify key fingerprints, allowing remote adversary to create an OpenPGP key which matches the short key ID and inject this key instead of the correct key.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2016-86142. NVD-2016-86143. OSV-2016-86144. OSV-DEBIAN-2016-86145. GHSA-cmwx-9m2h-x7v46. GCVE-2016-86147. SECURITY-TRACKER-CVE-2016-8614

References

1. https://github.com/ansible/ansible-modules-core/issues/52372. https://github.com/ansible/ansible-modules-core/pull/53533. https://github.com/ansible/ansible-modules-core/pull/53574. https://github.com/ansible/ansible-modules-core/commit/1182d1f0b76d56f3667e27987a10b9ec8f03357d5. https://github.com/ansible/ansible-modules-core/commit/66d47c8149d84e52f64b7c4d1f340d45dca94d9c6. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-86147. https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-37.yaml8. https://web.archive.org/web/20200227214450/https://www.securityfocus.com/bid/94108

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.