Ansible vulnerabilities

Releases

• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM
• Ubuntu 16.04 ESM

Packages

• ansible - Configuration management, deployment, and task execution system

Details

It was discovered that Ansible did not properly manage directory
permissions when running playbooks with an unprivileged become user. A
local attacker could possibly use this issue to cause a race condition,
escalate privileges and execute arbitrary code. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-1733)

It was discovered that the fix to address CVE-2020-1733 in Ansible was
incomplete on systems using ACLs and FUSE filesystems. A local attacker
could possibly use this issue to cause a race condition, escalate
privileges and execute arbitrary code. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-10744)

It was discovered that Ansible did not properly manage multi-line YAML
strings and special template characters. A local attacker could possibly
use this issue to cause a template injection, resulting in the
disclosure of sensitive information or other unspecified impact.
(CVE-2021-3583)

It was discovered that the ansible-connection module in Ansible did
not properly manage certain error messages. A local attacker could
possibly use this issue to expose sensitive information. This issue
only affected Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2021-3620)