Command Injection

2019-01-1509:14:44

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

59.8%

JSON

ansible is vulnerable to command injection. It is possible due to a lack of the returned facts validation, allowing a remote host running ansible or via escalated permissions to alter connection or interpreter settings by injecting malicious command through it.

CPENameOperatorVersion
ansibleeq1.9.3__2.el7aos
ansibleeq1.9.4__1.el7aos
ansibleeq1.9.4__1.el7_2
ansibleeq2.2.0.0__0.62.rc1.el7
openshift-ansibleeq3.2.36__1.git.0.164eb4c.el7
openshift-ansibleeq3.0.94__1.git.0.67a822a.el7
openshift-ansibleeq3.3.28__1.git.0.762256b.el7
openshift-ansibleeq3.0.88__1.git.0.31c3daf.el7
openshift-ansibleeq3.0.47__6.git.0.7e39163.el7aos
openshift-ansibleeq3.3.22__1.git.0.6c888c2.el7

Name	Operator	Version
ansible	eq	1.9.3__2.el7aos
ansible	eq	1.9.4__1.el7aos
ansible	eq	1.9.4__1.el7_2
ansible	eq	2.2.0.0__0.62.rc1.el7
openshift-ansible	eq	3.2.36__1.git.0.164eb4c.el7
openshift-ansible	eq	3.0.94__1.git.0.67a822a.el7
openshift-ansible	eq	3.3.28__1.git.0.762256b.el7
openshift-ansible	eq	3.0.88__1.git.0.31c3daf.el7
openshift-ansible	eq	3.0.47__6.git.0.7e39163.el7aos
openshift-ansible	eq	3.3.22__1.git.0.6c888c2.el7