CVE-2016-3096
Fixed in a distro release EPSS <1%
The create_script function in the lxc_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to arbitrary files or gain privileges via a symlink attack on (1) /opt/.lxc-attach-script, (2) the archived container in the archive_path directory, or the (3) lxc-attach-script.log or (4) lxc-attach-script.err files in the temporary directory.
Products: fedoraproject fedora, redhat ansible
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ansible | 2.0.2.0 |
| PyPI | ansible | 1.9.6.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ansible | 2.0.1.0-2 |
| Debian 13 | ansible | 2.0.1.0-2 |
| Debian 14 | ansible | 2.0.1.0-2 |
| Ubuntu 16.04 LTS | ansible | 2.0.0.2-2ubuntu1.3 |
| openSUSE Tumbleweed | ansible | 2.2.0.0-1.1 |
| openSUSE Tumbleweed | ansible-10 | 10.6.0-1.1 |
| openSUSE Tumbleweed | ansible-11 | 11.11.0-1.1 |
| openSUSE Tumbleweed | ansible-12 | 12.2.0-1.1 |
| openSUSE Tumbleweed | ansible-13 | 13.7.0-1.1 |
| openSUSE Tumbleweed | ansible-9 | 9.8.0-1.1 |