Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.3
CVE-2019-14904: Ansible Solaris Module: Malicious Zone Name Can Execute Commands
CVE-2019-14904 · published 6 years ago
Summary
A security issue in the Ansible Solaris module allows an attacker to execute arbitrary commands on a Solaris host by crafting a specially named zone. This affects versions of Ansible Engine 2.7 and earlier. To protect yourself, update to the latest version of Ansible.
What to do
- Update ansible ansible to version 2.7.16.
- Update ansible ansible to version 2.8.8.
- Update ansible ansible to version 2.9.3.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | redhat | ansible |
< 2.7.15 >= 2.8.0, < 2.8.7 >= 2.9.0, < 2.9.2 cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* |
| – | debian | debian_linux |
9.0 10.0 cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| pip | ansible | ansible |
< 2.7.16 >= 2.8.0a1, < 2.8.8 >= 2.9.0a1, < 2.9.3 Fix: upgrade to 2.7.16
|
Original advisory text
A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps'...
A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-14904
- https://github.com/ansible/ansible/pull/65686
- https://bugzilla.redhat.com/show_bug.cgi?id=1776944
- https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html
- https://www.debian.org/security/2021/dsa-4950
- https://github.com/ansible/ansible/commit/589a415f887b6f2bb65cd07fe6b2e9d0a8156b...
- https://github.com/ansible/ansible/commit/6a86650109b8654f5898369e45d3857624edf9...
- https://github.com/ansible/ansible/commit/a1b0f72c98b4b2afaab8aafa255e82c2075049...
- https://github.com/advisories/GHSA-gwr8-5j83-483c
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-161...
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-20Improper Input Validation
CWE-78OS Command Injection
Timeline
Published26 Aug 2020
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta