Vulnerability Name:

CVE-2017-7466 (CCN-145252)

Assigned:2017-07-26
Published:2017-07-26
Updated:2021-08-04
Summary:Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
CVSS v3 Severity:8.0 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
7.0 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
8.0 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
7.0 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:8.5 High (CVSS v2 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
9.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-20
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2017-7466

Source: BID
Type: Third Party Advisory, VDB Entry
97595

Source: CCN
Type: BID-97595
Ansible CVE-2017-7466 Incomplete Fix Arbitrary Command Execution Vulnerability

Source: REDHAT
Type: Third Party Advisory
RHSA-2017:1244

Source: REDHAT
Type: Third Party Advisory
RHSA-2017:1334

Source: REDHAT
Type: Third Party Advisory
RHSA-2017:1476

Source: REDHAT
Type: Third Party Advisory
RHSA-2017:1499

Source: REDHAT
Type: Third Party Advisory
RHSA-2017:1599

Source: REDHAT
Type: Third Party Advisory
RHSA-2017:1685

Source: CCN
Type: Red Hat Bugzilla – Bug 1439212
(CVE-2017-7466) CVE-2017-7466 ansible: Arbitrary code execution on control node (incomplete fix for CVE-2016-9587)

Source: CONFIRM
Type: Issue Tracking, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7466

Source: XF
Type: UNKNOWN
ansible-cve20177466-code-exec(145252)

Source: CCN
Type: Ansible Web site
Ansible is Simple IT Automation

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2017-7466

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redhat:ansible:*:*:*:*:*:*:*:* (Version < 2.3)

    • Configuration 2:
  • cpe:/a:redhat:openstack:11:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:openstack:10:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:redhat:ansible:2.2.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20177466
    V
    		CVE-2017-7466
    2022-06-30
    oval:org.opensuse.security:def:111931
    P
    		ansible-2.9.24-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:57109
    P
    		Security update for the Linux Kernel (Live Patch 39 for SLE 12 SP3) (Important)
    2021-10-18
    oval:org.opensuse.security:def:105499
    P
    		ansible-2.9.24-1.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:60340
    P
    		Security update for openssl-1_1 (Important)
    2021-08-24
    oval:org.opensuse.security:def:57977
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-07-27
    oval:org.opensuse.security:def:57953
    P
    		Security update for the Linux Kernel (Live Patch 33 for SLE 12 SP3) (Important)
    2021-06-18
    oval:org.opensuse.security:def:57003
    P
    		Security update for djvulibre (Important)
    2021-05-31
    oval:org.opensuse.security:def:57903
    P
    		Security update for the Linux Kernel (Live Patch 31 for SLE 12 SP3) (Important)
    2021-04-28
    oval:org.opensuse.security:def:59856
    P
    		Security update for python-cryptography (Important)
    2021-03-02
    oval:org.opensuse.security:def:57560
    P
    		Security update for python-cryptography (Important)
    2021-03-02
    oval:org.opensuse.security:def:60456
    P
    		Security update for tomcat (Moderate)
    2021-02-19
    oval:org.opensuse.security:def:60300
    P
    		Security update for postgresql, postgresql12, postgresql13 (Important)
    2021-01-26
    oval:org.opensuse.security:def:61058
    P
    		Security update for openexr (Moderate)
    2020-12-23
    oval:org.opensuse.security:def:57834
    P
    		Security update for the Linux Kernel (Live Patch 34 for SLE 12 SP3) (Important)
    2020-12-07
    oval:org.opensuse.security:def:60600
    P
    		Security update for postgresql10 (Important)
    2020-12-01
    oval:org.opensuse.security:def:56429
    P
    		Security update for libsoup (Important)
    2020-12-01
    oval:org.opensuse.security:def:60978
    P
    		Security update for java-1_8_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:60672
    P
    		Security update for python-PyKMIP (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57760
    P
    		libMagickCore-6_Q16-1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56830
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:61028
    P
    		Security update for java-1_8_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:60634
    P
    		Security update for openssl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57668
    P
    		apache2-mod_nss on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60111
    P
    		Security update for the Linux Kernel (Live Patch 30 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:56430
    P
    		Security update for strongswan (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60937
    P
    		Security update for galera-3, mariadb, mariadb-connector-c (Important)
    2020-12-01
    oval:org.opensuse.security:def:60552
    P
    		sysvinit-tools on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60899
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57275
    P
    		Security update for Xen
    2020-12-01
    oval:org.opensuse.security:def:56452
    P
    		Security update for cvs (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60790
    P
    		Security update for ansible, ardana-ansible, ardana-cinder, ardana-glance, ardana-mq, ardana-nova, ardana-osconfig, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-monasca-installer, openstack-neutron, openstack-nova, python-Django, python-Flask-Cors, python-Pillow, python-ardana-packager, python-keystoneclient, python-keystonemiddleware, python-kombu, python-straight-plugin, python-urllib3, release-notes-suse-openstack-cloud, storm, storm-kit, venv-openstack-cinder, venv-openstack-swift (Important)
    2020-12-01
    oval:org.opensuse.security:def:60815
    P
    		Security update for python3 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60711
    P
    		Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:57872
    P
    		libxerces-c-3_1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60718
    P
    		Security update for python3-requests (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60041
    P
    		Security update for bash (Important)
    2020-12-01
    oval:org.opensuse.security:def:56592
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60761
    P
    		Security update for java-1_8_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:84056
    P
    		Security update for ansible, ardana-ansible, ardana-cinder, ardana-glance, ardana-mq, ardana-nova, ardana-osconfig, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-monasca-installer, openstack-neutron, openstack-nova, python-Django, python-Flask-Cors, python-Pillow, python-ardana-packager, python-keystoneclient, python-keystonemiddleware, python-kombu, python-straight-plugin, python-urllib3, release-notes-suse-openstack-cloud, storm, storm-kit, venv-openstack-cinder, venv-openstack-swift (Important)
    2020-11-12
    oval:org.opensuse.security:def:84511
    P
    		Security update for ansible, ardana-ansible, ardana-cinder, ardana-glance, ardana-mq, ardana-nova, ardana-osconfig, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-monasca-installer, openstack-neutron, openstack-nova, python-Django, python-Flask-Cors, python-Pillow, python-ardana-packager, python-keystoneclient, python-keystonemiddleware, python-kombu, python-straight-plugin, python-urllib3, release-notes-suse-openstack-cloud, storm, storm-kit, venv-openstack-cinder, venv-openstack-swift (Important)
    2020-11-12
    oval:com.ubuntu.artful:def:20177466000
    V
    		CVE-2017-7466 on Ubuntu 17.10 (artful) - untriaged.
    2018-06-22
    oval:com.ubuntu.bionic:def:20177466000
    V
    		CVE-2017-7466 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-06-22
    oval:com.ubuntu.bionic:def:201774660000000
    V
    		CVE-2017-7466 on Ubuntu 18.04 LTS (bionic) - medium.
    2018-06-22
    oval:com.ubuntu.trusty:def:20177466000
    V
    		CVE-2017-7466 on Ubuntu 14.04 LTS (trusty) - medium.
    2018-06-22
    oval:com.ubuntu.xenial:def:201774660000000
    V
    		CVE-2017-7466 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-06-22
    oval:com.ubuntu.xenial:def:20177466000
    V
    		CVE-2017-7466 on Ubuntu 16.04 LTS (xenial) - medium.
    2018-06-22
    oval:org.opensuse.security:def:80612
    P
    		Security update for ansible and monasca-installer (Moderate)
    2017-11-17
    BACK
    redhat ansible *
    redhat openstack 11
    redhat openstack 10
    redhat ansible 2.2.3