Critical severity · published Jul 31, 2018
CVE-2016-8628
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller
9.1
CVSS
3.2%
EPSS
No
On KEV
Description
Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.2% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Ansible · Red Hat
2.2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-8628
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-8628
Third Party Advisory
http://www.securityfocus.com/bid/94109
Third Party Advisory
https://access.redhat.com/errata/RHSA-2016:2778
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8628
More from Ansible
7.5
CVE-2016-8614
A flaw was found in Ansible before version 2.2.0