CVE-2016-8628
- State
- Published
- Severity
- 7.6 High
- Published
- Jul 31, 2018
- Updated
- Aug 6, 2024
- Reserved
- Oct 12, 2016
Description
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 7.6 High | CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
AnsibleRed Hat |
|
References
- RHSA-2016:2778vendor-advisory
- 94109vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8628
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.