CVE-2019-14905: fedoraproject fedora Improper Input Validation
Vulnerability summary
CVE-2019-14905 is a high (CVSS 7.3) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 53.6% of scored vulnerabilities.
Not severe (CVSS 7.3, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 14 · Related 9Timeline
- 31-03-2020PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.
CVSS metrics
10 scores · 6 sources · 4 versions- OSV · AlpineEcosystem advisory · calculated5.6MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
- OSV · PypiEcosystem advisory · calculated5.6MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
- OSV · UbuntuEcosystem advisory · calculated5.6MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
- OSV · DebianEcosystem advisory · calculated5.6MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
- NVDNIST7.3HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
- OSV · UbuntuEcosystem advisory · calculated7.3HighCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
EPSS trend
Probability
0.71%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.71% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
- CWE-668Exposure of Resource to Wrong SphereThe product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
Affected systems
Known conditions: local access, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat5 products
- ansible_engine≥ 2.7.0, < 2.7.16 | ≥ 2.8.0, < 2.8.8 | ≥ 2.9.0, < 2.9.3
- ansible_tower3.0.0
- ceph_storage3.0
- cloudforms_management_engine5.0
- openstack13
Alpine2 products
- ansible< 2.8.8-r0 | < 2.9.3-r0 | < 2.7.16-r0
- ansible-base< 2.9.3-r0
Opensuse2 products
- backports_sle15.0:sp1
- leapEOL15.1
Debian1 product
- ansible< 2.9.4+dfsg-1
Fedoraproject1 product
- fedoraEOL30
PyPI1 product
- ansible≥ 2.7.0a1, < 2.7.16 | ≥ 2.8.0a1, < 2.8.8 | ≥ 2.9.0a1, < 2.9.3 | ≥ 2.9.0, < 2.9.3
Red hat1 product
- ansible2.9.x before 2.9.3 | 2.8.x before 2.8.8 | 2.7.x before 2.7.16 | 2.7.x and earlier
Ubuntu1 product
- ansibleAll versions (No fix recorded)
8 vendors · 14 products
References
17 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14905X Refsource CONFIRMIssue TrackingPatchVendor AdvisoryWEBREPORT
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryWEB
- lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party AdvisoryWEB
- github.com/ansible/ansiblePACKAGE
