Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Several vulnerabilities were discovered in Ansible, a configuration management, deployment, and task execution system.

CVE-2015-3908

A potential man-in-the-middle attack associated with insusfficient X.509 certificate verification. Ansible did not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2015-6240

A symlink attack that allows local users to escape a restricted environment (chroot or jail) via a symlink attack.

CVE-2018-10875

A fix potential arbitrary code execution resulting from reading ansible.cfg from a world-writable current working directory. This condition now causes ansible to emit a warning and ignore the ansible.cfg in the world-writable current working directory.

CVE-2019-10156

Information disclosure through unexpected variable substitution.

For Debian 8 'Jessie', these problems have been fixed in version 1.7.2+dfsg-2+deb8u2.

We recommend that you upgrade your ansible packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix CVE-2015-3908 to remove tabs and use spaces instead.
    This broke python parsing and in consequence Ansible.
    (bnc #941863)

ansible was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-3908: Fixed improper TLS Certificate Validation     (bsc#938161).

Ansible, Inc. reports :

Ensure that hostnames match certificate names when using HTTPS - resolved in Ansible 1.9.2

Improper symlink handling in zone, jail, and chroot connection plugins could lead to escape from confined environment - resolved in Ansible 1.9.2

ID	Name	Product	Family	Severity
128881	Debian DLA-1923-1 : ansible security update	Nessus	Debian Local Security Checks	high
85701	openSUSE Security Update : ansible (openSUSE-2015-557)	Nessus	SuSE Local Security Checks	medium
84999	openSUSE Security Update : ansible (openSUSE-2015-508)	Nessus	SuSE Local Security Checks	medium
84523	FreeBSD : ansible -- multiple vulnerabilities (72fccfdf-2061-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-3908

medium

Tenable Plugins

high

medium

medium

high