CVE-2018-10874
Fixed in a distro release EPSS <1%CVSS 7.8
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
Products: redhat ansible_engine, redhat openstack, redhat virtualization, redhat virtualization_host
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ansible | 2.4.6.0 |
| PyPI | ansible | 2.5.6 |
| PyPI | ansible | 2.6.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ansible | 2.6.1+dfsg-1 |
| Debian 13 | ansible | 2.6.1+dfsg-1 |
| Debian 14 | ansible | 2.6.1+dfsg-1 |
| Red Hat ansible engine 2 | ansible | 0:2.6.1-1.el7ae |
| Red Hat ansible engine 2.4 | ansible | 0:2.4.6.0-1.el7ae |
| Red Hat ansible engine 2.4 | ansible-doc | 0:2.4.6.0-1.el7ae |
| Red Hat ansible engine 2.5 | ansible | 0:2.5.6-1.el7ae |
| Red Hat ansible engine 2.5 | ansible-doc | 0:2.5.6-1.el7ae |
| Red Hat ansible engine 2.6 | ansible | 0:2.6.1-1.el7ae |
| Red Hat Enterprise Linux 7 | imgbased | 0:1.0.22-1.el7ev |
| Red Hat Enterprise Linux 7 | python-imgbased | 0:1.0.22-1.el7ev |
| Red Hat Enterprise Linux 7 | redhat-release-virtualization-host | 0:4.2-5.0.el7 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host | 0:4.2-20180724.0.el7_5 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host-image-update | 0:4.2-20180724.0.el7_5 |
| Red Hat Enterprise Linux 7 | redhat-virtualization-host-image-update-placeholder | 0:4.2-5.0.el7 |
| Red Hat openstack 10 | ansible | 0:2.4.6.0-1.el7ae |
| Red Hat openstack 12 | ansible | 0:2.4.6.0-1.el7ae |
| Red Hat openstack 12 | ansible-role-redhat-subscription | 0:1.0.1-4.el7ost |
| Red Hat openstack 13 | ansible | 0:2.4.6.0-1.el7ae |
| SUSE HPE Helion OpenStack 8 | ansible | 2.4.6.0-3.3.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | golang-github-prometheus-promu | 0.14.0-150000.3.18.2 |
| SUSE Manager Client Tools 15 | POS_Image-Graphical7 | 0.1.1710765237.46af599-150000.1.21.2 |
| SUSE Manager Client Tools 15 | POS_Image-JeOS7 | 0.1.1710765237.46af599-150000.1.21.2 |
| SUSE Manager Client Tools 15 | ansible | 2.9.27-150000.1.17.2 |
| SUSE Manager Client Tools 15 | dracut-saltboot | 0.1.1710765237.46af599-150000.1.53.2 |
| SUSE Manager Client Tools 15 | grafana | 9.5.18-150000.1.63.2 |
| SUSE Manager Client Tools 15 | mgr-daemon | 4.3.9-150000.1.47.2 |
| SUSE Manager Client Tools 15 | spacecmd | 4.3.27-150000.3.116.2 |
| SUSE Manager Client Tools 15 | spacewalk-client-tools | 4.3.19-150000.3.89.2 |
| SUSE Manager Client Tools 15 | spacewalk-koan | 4.3.6-150000.3.33.2 |
| SUSE Manager Client Tools 15 | uyuni-common-libs | 4.3.10-150000.1.39.2 |
| SUSE Manager Client Tools 15 | uyuni-proxy-systemd-services | 4.3.12-150000.1.21.2 |
| SUSE Manager Client Tools 15-BETA | POS_Image-Graphical7 | 0.1.1710765237.46af599-159000.3.24.2 |
| SUSE Manager Client Tools 15-BETA | POS_Image-JeOS7 | 0.1.1710765237.46af599-159000.3.24.2 |
| SUSE Manager Client Tools 15-BETA | ansible | 2.9.27-159000.3.12.2 |
| SUSE Manager Client Tools 15-BETA | dracut-saltboot | 0.1.1710765237.46af599-159000.3.33.2 |
| SUSE Manager Client Tools 15-BETA | grafana | 9.5.16-159000.4.30.2 |
| SUSE Manager Client Tools 15-BETA | spacecmd | 5.0.5-159000.6.48.2 |
| SUSE Manager Client Tools 15-BETA | spacewalk-client-tools | 5.0.4-159000.6.54.2 |
| SUSE Manager Client Tools 15-BETA | supportutils-plugin-susemanager-client | 5.0.3-159000.6.21.2 |
| SUSE Manager Client Tools 15-BETA | uyuni-tools | 0.1.7-159000.3.8.1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | golang-github-prometheus-node_exporter | 1.5.0-159000.6.2.1 |
| SUSE Manager Client Tools Beta for SLE Micro 5 | uyuni-tools | 0.1.7-159000.3.8.1 |
| SUSE Manager Client Tools for SLE Micro 5 | dracut-saltboot | 0.1.1710765237.46af599-150000.1.53.2 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-proxy-systemd-services | 4.3.12-150000.1.21.2 |
| SUSE Manager Proxy Module 4.3 | ansible | 2.9.27-150000.1.17.2 |
| SUSE Manager Proxy Module 4.3 | uyuni-proxy-systemd-services | 4.3.12-150000.1.21.2 |
| SUSE OpenStack Cloud 8 | ansible | 2.4.6.0-3.3.1 |
| SUSE OpenStack Cloud Crowbar 8 | ansible | 2.4.6.0-3.3.1 |
| Ubuntu 16.04 LTS | ansible | 2.0.0.2-2ubuntu1.3 |
| Ubuntu 18.04 LTS | ansible | 2.5.1+dfsg-1ubuntu0.1 |
| openSUSE Leap 15.5 | POS_Image-Graphical7 | 0.1.1710765237.46af599-150000.1.21.2 |
| openSUSE Leap 15.5 | POS_Image-JeOS7 | 0.1.1710765237.46af599-150000.1.21.2 |
| openSUSE Leap 15.5 | ansible | 2.9.27-150000.1.17.2 |
| openSUSE Leap 15.5 | dracut-saltboot | 0.1.1710765237.46af599-150000.1.53.2 |
| openSUSE Leap 15.5 | golang-github-prometheus-promu | 0.14.0-150000.3.18.2 |
| openSUSE Leap 15.5 | spacecmd | 4.3.27-150000.3.116.2 |