Riskcovery

CVE-2019-14904

State
Published
Severity
Not scored
Published
Aug 25, 2020
Updated
Aug 5, 2024
Reserved
Aug 10, 2019

Read the record on cve.org

Description

A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.

Scores

The record has no CVSS score.

Weaknesses

Affected Products

ProductVersions
Ansiblen/a
  • All versions before ansible-engine 2.9.4, before ansible-engine 2.8.8 and before ansible-engine 2.7.16Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.