CVSS 3.1
5.6 mediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:LCVE-2019-14905
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.
Severity
- EPSS
- 0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-668, CWE-20, CWE-73
- Published
- Modified
- Record from
- the NVD, synced
Affected
- fedoraproject:fedora
- opensuse:backports_sle
- opensuse:leap
- redhat:ansible_engine
- redhat:ansible_tower
- redhat:ceph_storage
- redhat:cloudforms_management_engine
- redhat:openstack
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-frxj-5j27-f8rf | PyPI | ansible | >=2.7.0a1 <2.7.16 | 2.7.16 |
| GHSA-frxj-5j27-f8rf | PyPI | ansible | >=2.8.0a1 <2.8.8 | 2.8.8 |
| GHSA-frxj-5j27-f8rf | PyPI | ansible | >=2.9.0a1 <2.9.3 | 2.9.3 |
| PYSEC-2020-206 | PyPI | ansible | >=2.7.0 <2.7.16 >=2.8.0 <2.8.8 >=2.9.0 <2.9.3 | 2.7.16, 2.8.8, 2.9.3 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html
- http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html
- https://access.redhat.com/errata/RHSA-2020:0216
- https://access.redhat.com/errata/RHSA-2020:0218
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14905