Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: redhat
Published: 2018-07-31T20:00:00
Updated: 2024-08-06T02:27:40.971Z
Reserved: 2016-10-12T00:00:00
Link: CVE-2016-8628
Vulnrichment
No data.
NVD
Status : Modified
Published: 2018-07-31T20:29:00.323
Modified: 2023-11-07T02:36:25.263
Link: CVE-2016-8628
Redhat