[SECURITY] [DSA 4396-1] ansible security update

🗓️ 19 Feb 2019 21:54:58Reported by DebianType

debian

debian🔗 lists.debian.org👁 163 Views

Vulnerabilities in Ansible package fixed in version 2.2.1.0-2+deb9u1

Reporter	Title	Published	Views	Family All 361
ATTACKERKB	CVE-2018-16876	3 Jan 201915:29	–	attackerkb
AlpineLinux	CVE-2018-10855	2 Jul 201818:00	–	alpinelinux
AlpineLinux	CVE-2018-10875	13 Jul 201822:00	–	alpinelinux
AlpineLinux	CVE-2018-16837	23 Oct 201815:00	–	alpinelinux
AlpineLinux	CVE-2018-16876	3 Jan 201915:00	–	alpinelinux
AlpineLinux	CVE-2019-3828	27 Mar 201900:00	–	alpinelinux
BDU FSTEC	The vulnerability of the Ansible configuration management system lies in the lack of control over the path used to locate the configuration file ansible.cfg, which allows a attacker to execute arbitrary code.	7 Feb 201900:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ansible configuration management system, related to the incorrect handling of the “no_log” option, allows a perpetrator to gain unauthorized access to sensitive information.	6 Mar 201900:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the “User” module in the Ansible configuration management system, related to the disclosure of data transmitted as parameters to the ssh-keygen utility, allows a hacker to gain unauthorized access to user-sensitive information.	6 Mar 201900:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ansible configuration management system, related to the disclosure of confidential data in vvv+ mode, allows a perpetrator to gain unauthorized access to information.	6 Mar 201900:00	–	bdu_fstec

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	9	any	ansible	2.2.1.0-2+deb9u1	ansible_2.2.1.0-2+deb9u1_any.deb

19 Feb 2019 21:54Current

7.3High risk

Vulners AI Score7.3

CVSS 24.6

CVSS 3.17.8

CVSS 37.8

EPSS0.03088

ansible configuration management deployment task execution information leak ansible.cfg user module ssh-keygen path traversal debian security advisory