—

PYSEC-2018-81

Details

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI / ansible

Introduced in: 0 Fixed in: 2.4.6.0

Fix pip install --upgrade 'ansible>=2.4.6.0'

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874 [REPORT]
https://access.redhat.com/errata/RHSA-2018:2166 [ADVISORY]
https://access.redhat.com/errata/RHSA-2018:2152 [ADVISORY]
https://access.redhat.com/errata/RHSA-2018:2151 [ADVISORY]
https://access.redhat.com/errata/RHSA-2018:2150 [ADVISORY]
https://access.redhat.com/errata/RHSA-2018:2321 [ADVISORY]
http://www.securitytracker.com/id/1041396 [WEB]
https://access.redhat.com/errata/RHSA-2018:2585 [ADVISORY]
https://access.redhat.com/errata/RHBA-2018:3788 [ADVISORY]
https://access.redhat.com/errata/RHSA-2019:0054 [ADVISORY]
https://usn.ubuntu.com/4072-1/ [WEB]