This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2016-8628 →

DEBIAN-CVE-2016-8628

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create specia...

Original description

The description as published by the source.

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ansible

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0.0-1"}]}]

Debian:13 ansible

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0.0-1"}]}]

Debian:14 ansible

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0.0-1"}]}]

References

advisory security-tracker.debian.org