Redhat Ansible vulnerabilities, page 3

45 vulnerabilities

Known vulnerabilities in Redhat Ansible, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.5CVE-2019-10156alpineansible+12
EPSS score
1.77%
A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.6.5CVE-2019-10206alpineansible+13
EPSS score
1.52%
ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain special characters. Passwords should be wrapped to prevent templates trigger and exposing them.6.5CVE-2019-10217alpineansible+6
EPSS score
1.87%
A flaw was found in ansible 2.8.0 before 2.8.4. Fields managing sensitive data should be set as such by no_log feature. Some of these fields in GCP modules are not set properly. service_account_contents() which is common class for all gcp modules is not setting no_log to True. Any sensitive data managed by that function would be leak as an output when running ansible playbooks.4.2CVE-2019-3828alpineansible+9
EPSS score
0.53%
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.7.8CVE-2023-5764debianansible+11
EPSS score
0.54%
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.