5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
5.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
0.003 Low
EPSS
Percentile
69.9%
Package : ansible
Version : 1.7.2+dfsg-2+deb8u2
CVE ID : CVE-2015-3908 CVE-2015-6240 CVE-2018-10875 CVE-2019-10156
Debian Bug : 930065
Several vulnerabilities were discovered in Ansible, a configuration
management, deployment, and task execution system.
CVE-2015-3908
A potential man-in-the-middle attack associated with insusfficient
X.509 certificate verification. Ansible did not verify that the
server hostname matches a domain name in the subject's Common Name
(CN) or subjectAltName field of the X.509 certificate, which allows
man-in-the-middle attackers to spoof SSL servers via an arbitrary
valid certificate.
CVE-2015-6240
A symlink attack that allows local users to escape a restricted
environment (chroot or jail) via a symlink attack.
CVE-2018-10875
A fix potential arbitrary code execution resulting from reading
ansible.cfg from a world-writable current working directory. This
condition now causes ansible to emit a warning and ignore the
ansible.cfg in the world-writable current working directory.
CVE-2019-10156
Information disclosure through unexpected variable substitution.
For Debian 8 "Jessie", these problems have been fixed in version
1.7.2+dfsg-2+deb8u2.
We recommend that you upgrade your ansible packages.
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
Debian | 8 | all | ansible-node-fireball | < 1.7.2+dfsg-2+deb8u2 | ansible-node-fireball_1.7.2+dfsg-2+deb8u2_all.deb |
Debian | 10 | all | ansible-doc | < 2.7.7+dfsg-1+deb10u1 | ansible-doc_2.7.7+dfsg-1+deb10u1_all.deb |
Debian | 8 | all | ansible-doc | < 1.7.2+dfsg-2+deb8u2 | ansible-doc_1.7.2+dfsg-2+deb8u2_all.deb |
Debian | 8 | all | ansible-fireball | < 1.7.2+dfsg-2+deb8u2 | ansible-fireball_1.7.2+dfsg-2+deb8u2_all.deb |
Debian | 9 | all | ansible | < 2.2.1.0-2+deb9u2 | ansible_2.2.1.0-2+deb9u2_all.deb |
Debian | 10 | all | ansible | < 2.7.7+dfsg-1+deb10u1 | ansible_2.7.7+dfsg-1+deb10u1_all.deb |
Debian | 8 | all | ansible | < 1.7.2+dfsg-2+deb8u2 | ansible_1.7.2+dfsg-2+deb8u2_all.deb |
5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
5.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:P/I:P/A:N
0.003 Low
EPSS
Percentile
69.9%