CVE-2018-10874

ansible: Inventory variables are loaded from current working directory when running ad-hoc command that can lead to code execution

Loading…

Severity

Moderate

Red Hat Product Security

7.8

CVSS 3.0

Review impact separately from score.

Published · June 29, 2018

Updated · June 30, 2026

Description

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

Statement

Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.0 · 7.8
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-20 · Improper Input Validation