The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:0217 advisory.

    Ansible is a simple model-driven configuration management,     multi-node deployment, and remote-task execution system. Ansible works over     SSH and does not require any software or daemons to be installed on remote     nodes. Extension modules can be written in any language and are transferred     to managed machines automatically.

    The following packages have been upgraded to a newer upstream version: ansible (2.7.16)

    Bug Fix(es):
    * CVE-2019-14904 Ansible: vulnerability in solaris_zone module via crafted solaris zone
    * CVE-2019-14905 Ansible: malicious code could craft filename in nxos_file_copy module

    See: https://github.com/ansible/ansible/blob/v2.7.16/changelogs/CHANGELOG-v2.7.rst for details on bug     fixes in this release.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of ansible installed on the remote host is prior to 2.9.5-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ANSIBLE2-2023-009 advisory.

    A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for     the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command     on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and     executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as     previous versions are affected. (CVE-2019-14904)

    A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before     2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or     bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command     injections. This could result in a loss of confidentiality of the system among other issues.
    (CVE-2019-14905)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The CentOS Linux 6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS6:CLSA-2026:1777489309 advisory.

  - A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for     the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command     on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and     executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as     previous versions are affected. (CVE-2019-14904)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0218 advisory.

    Ansible is a simple model-driven configuration management, multi-node     deployment, and remote-task execution system. Ansible works over SSH and     does not require any software or daemons to be installed on remote nodes.
    Extension modules can be written in any language and are transferred to     managed machines automatically.

    The following packages have been upgraded to a newer upstream version:
    ansible (2.9.4)

    Bug Fix(es):
    * CVE-2019-14904 Ansible: vulnerability in solaris_zone module via crafted     solaris zone
    * CVE-2019-14905 Ansible: malicious code could craft filename in     nxos_file_copy module

    See:
    https://github.com/ansible/ansible/blob/v2.9.4/changelogs/CHANGELOG-v2.9.rst     for details on bug fixes in this release.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to bugfix release 2.9.3. See https://github.com/ansible/ansible/blob/stable-2.9/changelogs/CHANGELO G-v2.9.rst

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

CVE-2017-7481

Ansible fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.

CVE-2019-10156

A flaw was discovered in the way Ansible templating was implemented, causing the possibility of information disclosure through unexpected variable substitution. By taking advantage of unintended variable substitution the content of any variable may be disclosed.

CVE-2019-14846

Ansible was logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those are executed in a separate process.

CVE-2019-14904

A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host.

For Debian 9 stretch, these problems have been fixed in version 2.2.1.0-2+deb9u2.

We recommend that you upgrade your ansible packages.

For the detailed security status of ansible please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/ansible

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
133248	RHEL 7 : Ansible security update (2.7.16) (Moderate) (RHSA-2020:0217)	Nessus	Red Hat Local Security Checks	2020/1/27	2024/11/8	high
182053	Amazon Linux 2 : ansible (ALASANSIBLE2-2023-009)	Nessus	Amazon Linux Local Security Checks	2023/9/27	2024/12/11	high
360100	CentOS Linux 6 [TuxCare] Security Update: ansible / ansible-doc (CENTOS6:CLSA-2026:1777489309)	Nessus	CentOS Local Security Checks	2026/10/1	2026/10/1	high
133249	RHEL 7 / 8 : Ansible security update (2.9.4) (Moderate) (RHSA-2020:0218)	Nessus	Red Hat Local Security Checks	2020/1/27	2024/11/7	high
133367	Fedora 30 : ansible (2020-2bed89517f)	Nessus	Fedora Local Security Checks	2020/1/31	2020/9/4	high
145531	Debian DLA-2535-1 : ansible security update	Nessus	Debian Local Security Checks	2021/1/28	2022/2/3	critical

检测

插件搜索

high

high

high

high

high

critical