CVE-2019-14904

Katalog CVE

CVSS 7.3 · High EPSS 0,42%

Kerentanan Improper Input Validation pada redhat ansible, debian linux. Skor CVSS 3.1 7.3 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.

Rincian

Terbit di NVD

26 Agustus 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.3 (High), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

0,42% peluang dieksploitasi; lebih tinggi dari 34,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1776944 issue tracking · advisory vendor
• https://github.com/ansible/ansible/pull/65686 patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4950 advisory pihak ketiga