IBM22E43DB2CC030F8B523C4AE453AFA9DAD50F57E846A5F0A65DD7187A02EDCE7ESecurity Bulletin: A security vulnerability has been identified in Ansible shipped with Data Science Experience Local
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P
Summary
Ansible is shipped as a component of Data Science Experience Local. Information about a security vulnerability affecting Ansible has been published in a security bulletin.
Vulnerability Details
CVEID: CVE-2018-10874 DESCRIPTION: Ansible could allow a local authenticated attacker to execute arbitrary code on the system. By using a specially-crafted variables, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base Score: 7.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/145689> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
| Principal Product and Version(s) | Affected Supporting Product and Versions |
|---|---|
| IBM Data Science Experience Local 1.1.0 | Ansible 2.5.4 |
| IBM Data Science Experience Local 1.1.1 | Ansible 2.5.4 |
| IBM Data Science Experience Local 1.1.2 | Ansible 2.5.4 |
| IBM Data Science Experience Local 1.1.3 | Ansible 2.5.4 |
| IBM Data Science Experience Local 1.2.0 | Ansible 2.5.4 |
Remediation/Fixes
Upgrade to the 1.2 release of IBM Data Science Experience Local. You can download the latest release from Passport Advantage.
Part Name
| Part number
—|—
IBM Data Science Experience Local Enterprise Edition V1.2 Memo to Users English Only | CNJE9EN.pdf
Workarounds and Mitigations
None
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm data science experience local | eq | any |
Related
7.8 High
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.6 Medium
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:L/AC:L/Au:N/C:P/I:P/A:P