Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.

Ansible changelog reports :

Host key checking is on by default. Disable it if you like by adding host_key_checking=False in the [default] section of /etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting ANSIBLE_HOST_KEY_CHECKING=False.

Upstream 1.2.2 version. See:
https://groups.google.com/forum/#!topic/ansible-project/Bj0TmfsExhk for more info.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
84526	FreeBSD : ansible -- enable host key checking in paramiko connection type (a478421e-2059-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
68885	Fedora 17 : ansible-1.2.2-1.fc17 (2013-12400)	Nessus	Fedora Local Security Checks	high
68883	Fedora 18 : ansible-1.2.2-1.fc18 (2013-12394)	Nessus	Fedora Local Security Checks	high
68882	Fedora 19 : ansible-1.2.2-1.fc19 (2013-12389)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2013-2233

high

Tenable Plugins

high

high

high

high