CVE-2018-10874 | BDVDB-2026-103229 Detail
[UNKNOWN]ansible
Description#
In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
Impact#
Per CVSS v3.0: confidentiality impact high, integrity impact high, availability impact high. Attack vector: local.
Weaknesses#
References#
- https://access.redhat.com/errata/RHSA-2018:2166
- https://access.redhat.com/errata/RHSA-2018:2152
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874
- https://access.redhat.com/errata/RHSA-2018:2150
- http://www.securitytracker.com/id/1041396
- https://access.redhat.com/errata/RHBA-2018:3788
- https://access.redhat.com/errata/RHSA-2019:0054
- https://access.redhat.com/errata/RHSA-2018:2151
- https://access.redhat.com/errata/RHSA-2018:2321
- https://access.redhat.com/errata/RHSA-2018:2585
- https://usn.ubuntu.com/4072-1/
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.