CVE-2015-3908
Fixed in a distro release EPSS <1%
Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Products: redhat ansible
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ansible | 1.9.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ansible | 1.9.2+dfsg-1 |
| Debian 13 | ansible | 1.9.2+dfsg-1 |
| Debian 14 | ansible | 1.9.2+dfsg-1 |
| Debian 8 | ansible | 1.7.2+dfsg-2+deb8u2 |
| Ubuntu Pro 14.04 LTS | ansible | 1.5.4+dfsg-1ubuntu0.1~esm3 |
| Ubuntu Pro 16.04 LTS | ansible | 2.0.0.2-2ubuntu1.3+esm5 |
| Ubuntu Pro 18.04 LTS | ansible | 2.5.1+dfsg-1ubuntu0.1+esm5 |
| Ubuntu Pro 20.04 LTS | ansible | 2.9.6+dfsg-1ubuntu0.1~esm3 |
| openSUSE Tumbleweed | ansible | 2.2.0.0-1.1 |
| openSUSE Tumbleweed | ansible-10 | 10.6.0-1.1 |
| openSUSE Tumbleweed | ansible-11 | 11.11.0-1.1 |
| openSUSE Tumbleweed | ansible-12 | 12.2.0-1.1 |
| openSUSE Tumbleweed | ansible-13 | 13.7.0-1.1 |
| openSUSE Tumbleweed | ansible-9 | 9.8.0-1.1 |