Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

ansible-core

8 known vulnerabilities (3 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 3 high, 5 medium
Weekly downloads
4M
Dependents
318
Registry
PyPI

Advisories 8

  • CVE-2026-123036Medium 5.5

    A flaw was found in ansible-core.

    Affected: from 2.19.0, fixed in 2.23.0.

  • Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

    Affected: fixed in 2.16.19rc1; from 2.17.0b1, fixed in 2.18.18rc1; from 2.19.0b1, fixed in 2.19.11rc1; from 2.20.0b1, fixed in 2.20.7rc1; from 2.21.0b1, fixed in 2.21.1rc1; fixed in 2.16.19rc1; from 2.17.0b1, fixed in 2.18.18rc1; from 2.19.0b1, fixed in 2.19.11rc1; from 2.20.0b1, fixed in 2.20.7rc1; from 2.21.0b1, fixed in 2.21.1rc1.

  • CVE-2024-11079Medium 5.5

    Ansible-core: unsafe tagging bypass via hostvars object in ansible-core

    Affected: from 2.18.0b1, fixed in 2.18.1rc1; from 2.17.0b1, fixed in 2.17.7rc1; fixed in 2.16.14rc1; fixed in 2.16.14rc1; from 2.17.0b1, fixed in 2.17.7rc1; from 2.18.0b1, fixed in 2.18.1rc1.

  • CVE-2024-9902Medium 6.3

    Ansible-core: ansible-core user may read/write unauthorized content

    Affected: fixed in 2.14.18rc1; from 2.15.0b1, fixed in 2.15.13rc1; from 2.16.0b1, fixed in 2.16.13rc1; from 2.17.0b1, fixed in 2.17.6rc1; from 2.18.0b1, fixed in 2.18.0rc2; fixed in 2.14.18rc1; from 2.15.0b1, fixed in 2.15.13rc1; from 2.16.0b1, fixed in 2.16.13rc1; from 2.17.0b1, fixed in 2.17.6rc1; from 2.18.0b1, fixed in 2.18.0rc2.

  • CVE-2024-8775Medium 5.5

    Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

    Affected: from 2.17.0b1, fixed in 2.17.6; fixed in 2.16.13; fixed in 2.16.13; from 2.17.0b1, fixed in 2.17.6.

  • CVE-2024-0690Medium 5.0

    Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration

    Affected: fixed in 2.14.14; from 2.16.0, fixed in 2.16.3; from 2.15.0, fixed in 2.15.9; fixed in 2.14.4; from 2.15.0, fixed in 2.15.9; from 2.16.0, fixed in 2.16.3.

  • Ansible: template injection

    Affected: from 2.16.0, fixed in 2.16.1; from 2.15.0, fixed in 2.15.8; fixed in 2.14.12; fixed in 2.14.12; from 2.15.0, fixed in 2.15.8; from 2.16.0, fixed in 2.16.1.

  • Platform: ec2_key module prints out the private key directly to the standard output

    Affected: from 2.8.0, through 2.15.2.