CVE Vulnerability

CVE-2019-14904

A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.

6.1 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 8.5

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

7.3 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 1.5 / Impact : 5.3

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://github.com/ansible/ansible/pull/65686 Patch Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1776944 Issue Tracking Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html Mailing List Third Party Advisory
https://www.debian.org/security/2021/dsa-4950 Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Information

Published : 2020-08-26 03:15

Updated : 2022-04-22 06:53

NVD link : CVE-2019-14904

Mitre link : CVE-2019-14904

Products Affected

Ansible

Redhat

CWE
CWE-20

CWE-78