CVE-2016-9587: Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems

Description

Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)17.1% · higher than 97% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AN

Ansible · Redhat

before 2.1.4 · source: NVD

OP

Openstack · Redhat

11 · source: NVD