# ansible (PyPI) vulnerabilities 67 known vulnerabilities (11 high, 23 medium, 6 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://pypi.org/project/ansible/ ## Advisories (67) ### [CVE-2025-14010](https://cve.now/CVE-2025-14010): Ansible-collection-community-general: ansible-collection-community-general: keycloak user module leaks credentials in verbose output - Severity: Medium 5.5 - Published: Dec 4, 2025 - Affected: fixed in 12.2.0. ### [CVE-2023-5115](https://cve.now/CVE-2023-5115): Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files - Severity: Medium 6.3 - Published: Dec 18, 2023 - Affected: fixed in 8.5.0. ### [CVE-2022-3697](https://cve.now/CVE-2022-3697): A flaw was found in Ansible in the amazon.aws collection when using the tower\_callback parameter from the amazon.aws.ec2\_instance module. - Severity: Unrated - Published: Oct 28, 2022 - Affected: from 2.5.0, fixed in 7.0.0. ### [CVE-2021-20180](https://cve.now/CVE-2021-20180): A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature… - Severity: Unrated - Published: Mar 16, 2022 - Affected: from 2.8.0a1, fixed in 2.8.19; from 2.9.0b1, fixed in 2.9.18; from 2.8.0a1, fixed in 2.8.19; from 2.9.0b1, fixed in 2.9.18. ### [CVE-2021-3620](https://cve.now/CVE-2021-3620): A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is… - Severity: Unrated - Published: Mar 3, 2022 - Affected: fixed in 2.9.27. ### [CVE-2021-3583](https://cve.now/CVE-2021-3583): A flaw was found in Ansible, where a user's controller is vulnerable to template injection. - Severity: Unrated - Published: Sep 22, 2021 - Affected: fixed in 2.9.23rc1; from 2.10.0a1, fixed in 2.10.11rc1; from 2.11.0a1, fixed in 2.11.2rc1; fixed in 2.9.23. ### [CVE-2020-10729](https://cve.now/CVE-2020-10729): A flaw was found in the use of insufficiently random values in Ansible. - Severity: Unrated - Published: May 27, 2021 - Affected: fixed in 2.9.6. ### [CVE-2021-20191](https://cve.now/CVE-2021-20191): A flaw was found in ansible. - Severity: Unrated - Published: May 26, 2021 - Affected: fixed in 2.8.19; from 2.9.0, fixed in 2.9.18; from 2.10.0, fixed in 2.10.7; from 2.9.0a1, fixed in 2.9.18rc1; fixed in 2.8.19rc1; from 2.10.0a1, fixed in 2.10.7. ### [CVE-2021-20178](https://cve.now/CVE-2021-20178): A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature… - Severity: Unrated - Published: May 26, 2021 - Affected: fixed in 2.9.18. ### [CVE-2021-20228](https://cve.now/CVE-2021-20228): A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no\_log feature… - Severity: Unrated - Published: Apr 29, 2021 - Affected: from 2.10.0a1, fixed in 2.10.6rc1; from 2.9.0a1, fixed in 2.9.18rc1; fixed in 2.8.19rc1; fixed in 2.9.19. ### [CVE-2021-3447](https://cve.now/CVE-2021-3447): A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on… - Severity: Unrated - Published: Apr 1, 2021 - Affected: fixed in 1.2.2. ### [CVE-2020-25635](https://cve.now/CVE-2020-25635): A flaw was found in Ansible Base when using the aws\_ssm connection plugin as garbage collector is not happening after playbook run is… - Severity: Medium 5.0 - Published: Oct 5, 2020 - Affected: fixed in 2.10.1. ### [CVE-2020-14365](https://cve.now/CVE-2020-14365): A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing… - Severity: Unrated - Published: Sep 23, 2020 - Affected: from 2.8.0a1, fixed in 2.8.15; from 2.9.0a1, fixed in 2.9.13; from 2.8.0, fixed in 2.8.16rc1; from 2.9.0, fixed in 2.9.14rc1. ### [CVE-2020-14332](https://cve.now/CVE-2020-14332): A flaw was found in the Ansible Engine when using module\_args. - Severity: Medium 5.5 - Published: Sep 11, 2020 - Affected: fixed in 2.8.14; from 2.9.0a1, fixed in 2.9.12; from 2.10.0a1, fixed in 2.10.1rc2; from 2.8.0, fixed in 2.8.14; from 2.9.0, fixed in 2.9.12. ### [CVE-2020-14330](https://cve.now/CVE-2020-14330): An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content… - Severity: Medium 5.0 - Published: Sep 11, 2020 - Affected: fixed in 2.10.0; fixed in 2.10.0. ### [CVE-2019-14904](https://cve.now/CVE-2019-14904): A flaw was found in the solaris\_zone module from the Ansible Community modules. - Severity: Unrated - Published: Aug 25, 2020 - Affected: fixed in 2.7.16; from 2.8.0a1, fixed in 2.8.8; from 2.9.0a1, fixed in 2.9.3; fixed in 2.7.15; from 2.8.0, fixed in 2.8.7; from 2.9.0, fixed in 2.9.2. ### [CVE-2020-10744](https://cve.now/CVE-2020-10744): An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become\_user from… - Severity: Medium 5.0 - Published: May 15, 2020 - Affected: from 2.10.0a1, fixed in 2.10.0rc1; fixed in 2.9.12; from 2.7.0, fixed in 2.8.0a1; from 2.8.0, fixed in 2.8.13; from 2.9.0, fixed in 2.9.10. ### [CVE-2020-1746](https://cve.now/CVE-2020-1746): A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before… - Severity: Medium 5.0 - Published: May 12, 2020 - Affected: from 2.7.0, fixed in 2.7.17; from 2.8.0, fixed in 2.8.11; from 2.9.0, fixed in 2.9.7; from 2.8.0a1, fixed in 2.8.11; from 2.9.0a1, fixed in 2.9.7; from 2.7.0a1, fixed in 2.7.17. ### [CVE-2020-10685](https://cve.now/CVE-2020-10685): A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as… - Severity: Medium 5.0 - Published: May 11, 2020 - Affected: from 2.7.0, fixed in 2.7.17; from 2.8.0, fixed in 2.8.11; from 2.9.0, fixed in 2.9.7; from 2.7.0a1, fixed in 2.7.17; from 2.8.0a1, fixed in 2.8.11; from 2.9.0a1, fixed in 2.9.7. ### [CVE-2020-10691](https://cve.now/CVE-2020-10691): An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. - Severity: Medium 5.2 - Published: Apr 30, 2020 - Affected: from 2.9.0, fixed in 2.9.7; from 2.9.0a1, fixed in 2.9.7. ### [CVE-2019-14905](https://cve.now/CVE-2019-14905): A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in… - Severity: High 7.3 - Published: Mar 31, 2020 - Affected: from 2.7.0, fixed in 2.7.16; from 2.8.0, fixed in 2.8.8; from 2.9.0, fixed in 2.9.3; from 2.7.0a1, fixed in 2.7.16; from 2.8.0a1, fixed in 2.8.8; from 2.9.0a1, fixed in 2.9.3. ### [CVE-2020-10684](https://cve.now/CVE-2020-10684): A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using… - Severity: High 7.9 - Published: Mar 24, 2020 - Affected: from 2.7.0, fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6; from 2.7.0a1, fixed in 2.7.17; from 2.8.0a1, fixed in 2.8.11; from 2.9.0a1, fixed in 2.9.7. ### [CVE-2020-1738](https://cve.now/CVE-2020-1738): A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. - Severity: Low 3.9 - Published: Mar 16, 2020 - Affected: fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6; through 2.7.16; from 2.8.0a1, through 2.8.10; from 2.9.0a1, through 2.9.6. ### [CVE-2020-1740](https://cve.now/CVE-2020-1740): A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. - Severity: Low 3.9 - Published: Mar 16, 2020 - Affected: fixed in 2.7.17; from 2.8.0a1, fixed in 2.8.11; from 2.9.0a1, fixed in 2.9.7; fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6. ### [CVE-2020-1735](https://cve.now/CVE-2020-1735): A flaw was found in the Ansible Engine when the fetch module is used. - Severity: Medium 4.2 - Published: Mar 16, 2020 - Affected: fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6; from 2.7.0a1, fixed in 2.7.18; from 2.8.0a1, fixed in 2.8.12; from 2.9.0a1, fixed in 2.9.8. ### [CVE-2020-1736](https://cve.now/CVE-2020-1736): A flaw was found in Ansible Engine when a file is moved using atomic\_move primitive as the file mode cannot be specified. - Severity: Low 2.2 - Published: Mar 16, 2020 - Affected: from 2.7.0, through 2.10.0; fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6. ### [CVE-2020-1753](https://cve.now/CVE-2020-1753): A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and… - Severity: Medium 5.0 - Published: Mar 16, 2020 - Affected: fixed in 2.7.18; from 2.8.0, fixed in 2.8.11; from 2.9.0, fixed in 2.9.7; from 2.7.0a1, fixed in 2.7.18; from 2.8.0a1, fixed in 2.8.12; from 2.9.0a1, fixed in 2.9.7. ### [CVE-2020-1739](https://cve.now/CVE-2020-1739): A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of… - Severity: Low 3.9 - Published: Mar 12, 2020 - Affected: fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6; fixed in 2.7.17; from 2.8.0a1, fixed in 2.8.11; from 2.9.0a1, fixed in 2.9.7. ### [CVE-2020-1733](https://cve.now/CVE-2020-1733): A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an… - Severity: Medium 5.0 - Published: Mar 11, 2020 - Affected: fixed in 2.7.17; from 2.8.0, fixed in 2.8.8; from 2.9.0, fixed in 2.9.6; fixed in 2.7.17; from 2.8.0a1, fixed in 2.8.11; from 2.9.0a1, fixed in 2.9.7. ### [CVE-2020-1737](https://cve.now/CVE-2020-1737): A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win\_unzip… - Severity: High 7.5 - Published: Mar 9, 2020 - Affected: from 2.8.0a1, fixed in 2.8.9; from 2.9.0a1, fixed in 2.9.6; fixed in 2.7.17; fixed in 2.7.17; from 2.8.0, fixed in 2.8.9; from 2.9.0, fixed in 2.9.6. ### [CVE-2020-1734](https://cve.now/CVE-2020-1734): A flaw was found in the pipe lookup plugin of ansible. - Severity: High 7.4 - Published: Mar 3, 2020 - Affected: from 2.10.0a1, fixed in 2.10.0rc1; from 2.9.0a1, fixed in 2.9.11; fixed in 2.8.13; fixed in 2.7.17. ### [CVE-2014-4659](https://cve.now/CVE-2014-4659): Ansible before 1.5.5 sets 0644 permissions for sources.list, which might allow local users to obtain sensitive credential information in… - Severity: Unrated - Published: Feb 20, 2020 - Affected: fixed in 1.5.5. ### [CVE-2014-4658](https://cve.now/CVE-2014-4658): The vault subsystem in Ansible before 1.5.5 does not set the umask before creation or modification of a vault file, which allows local… - Severity: Unrated - Published: Feb 20, 2020 - Affected: fixed in 1.5.5. ### [CVE-2014-4657](https://cve.now/CVE-2014-4657): The safe\_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute… - Severity: Unrated - Published: Feb 20, 2020 - Affected: fixed in 1.5.4. ### [CVE-2014-4678](https://cve.now/CVE-2014-4678): The safe\_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute… - Severity: Unrated - Published: Feb 20, 2020 - Affected: fixed in 1.6.4; fixed in 1.6.4. ### [CVE-2014-4660](https://cve.now/CVE-2014-4660): Ansible before 1.5.5 constructs filenames containing user and password fields on the basis of deb lines in sources.list, which might allow… - Severity: Unrated - Published: Feb 20, 2020 - Affected: fixed in 1.5.5; fixed in 1.5.5. ### [CVE-2014-4967](https://cve.now/CVE-2014-4967): Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access… - Severity: Unrated - Published: Feb 18, 2020 - Affected: fixed in 1.6.7; fixed in 1.6.7. ### [CVE-2014-4966](https://cve.now/CVE-2014-4966): Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{"… - Severity: Unrated - Published: Feb 18, 2020 - Affected: fixed in 1.6.7; fixed in 1.6.7. ### [CVE-2014-2686](https://cve.now/CVE-2014-2686): Ansible prior to 1.5.4 mishandles the evaluation of some strings. - Severity: Unrated - Published: Jan 9, 2020 - Affected: fixed in 1.5.4. ### [CVE-2019-14864](https://cve.now/CVE-2019-14864): Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, is not respecting the flag no\_log set… - Severity: Medium 5.7 - Published: Jan 2, 2020 - Affected: from 2.7.0, fixed in 2.7.15; from 2.8.0, fixed in 2.8.7; from 2.9.0, fixed in 2.9.1; from 2.7.0a1, fixed in 2.7.15; from 2.8.0a1, fixed in 2.8.7; from 2.9.0a1, fixed in 2.9.1. ### [CVE-2019-14856](https://cve.now/CVE-2019-14856): ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None - Severity: Medium 6.4 - Published: Nov 26, 2019 - Affected: from 2.6.0, fixed in 2.6.20; from 2.7.0, fixed in 2.7.14; from 2.8.0, fixed in 2.8.6; from 2.8.0, fixed in 2.8.6; from 2.7.0, fixed in 2.7.14; from 2.6.0, fixed in 2.6.20. ### [CVE-2019-10217](https://cve.now/CVE-2019-10217): A flaw was found in ansible 2.8.0 before 2.8.4. - Severity: Medium 5.7 - Published: Nov 25, 2019 - Affected: from 2.8.0, fixed in 2.8.4; from 2.8.0a1, fixed in 2.8.4. ### [CVE-2019-10206](https://cve.now/CVE-2019-10206): ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt… - Severity: Medium 6.4 - Published: Nov 22, 2019 - Affected: from 2.6.0, fixed in 2.6.19; from 2.7.0, fixed in 2.7.13; from 2.8.0, fixed in 2.8.4; from 2.8.0, fixed in 2.8.4; from 2.7.0, fixed in 2.7.13; from 2.6.0, fixed in 2.6.19. ### [CVE-2019-14858](https://cve.now/CVE-2019-14858): A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5. - Severity: High 7.3 - Published: Oct 14, 2019 - Affected: from 2.9.0a1, fixed in 2.9.0rc4; from 2.8.0a1, fixed in 2.8.6; from 2.7.0a1, fixed in 2.7.14; from 2.0, fixed in 2.6.20; from 2.0, fixed in 2.8.1. ### [CVE-2019-14846](https://cve.now/CVE-2019-14846): In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the… - Severity: High 7.3 - Published: Oct 8, 2019 - Affected: fixed in 2.6.20; from 2.7.0, fixed in 2.7.14; from 2.8.0, fixed in 2.8.6; fixed in 2.6.20; from 2.7.0a1, fixed in 2.7.14; from 2.8.0a1, fixed in 2.8.6. ### [CVE-2019-10156](https://cve.now/CVE-2019-10156): A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2, causing the possibility… - Severity: Medium 4.6 - Published: Jul 30, 2019 - Affected: fixed in 2.6.18; from 2.7.0a1, fixed in 2.7.12; from 2.8.0a1, fixed in 2.8.2; fixed in 2.6.18; from 2.7.0, fixed in 2.7.12; from 2.8.0, fixed in 2.8.2. ### [CVE-2019-3828](https://cve.now/CVE-2019-3828): Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files… - Severity: Medium 4.2 - Published: Mar 27, 2019 - Affected: from 2.5.0, fixed in 2.5.15; from 2.6.0, fixed in 2.6.14; from 2.7.0, fixed in 2.7.8; fixed in 2.5.15; from 2.6.0a1, fixed in 2.6.14; from 2.7.0a1, fixed in 2.7.8. ### [CVE-2018-16876](https://cve.now/CVE-2018-16876): ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no\_log on that can lead to… - Severity: Low 3.1 - Published: Jan 3, 2019 - Affected: fixed in 2.5.14; from 2.6.0a1, fixed in 2.6.11; from 2.7.0a1, fixed in 2.7.5; from 2.5.0, fixed in 2.5.14; from 2.6.0, fixed in 2.6.11; from 2.7.0, fixed in 2.7.5. ### [CVE-2018-16859](https://cve.now/CVE-2018-16859): Execution of Ansible playbooks on Windows platforms with PowerShell ScriptBlock logging and Module logging enabled can allow for 'become'… - Severity: Medium 4.2 - Published: Nov 29, 2018 - Affected: from 2.7.0, fixed in 2.7.4; from 2.7.5, fixed in 2.8.1; fixed in 2.5.13; from 2.6.0, fixed in 2.6.10; from 2.7.0a1, fixed in 2.7.3; fixed in 2.5.12; from 2.6.0a1, fixed in 2.6.9. ### [CVE-2018-16837](https://cve.now/CVE-2018-16837): Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. - Severity: High 7.8 - Published: Oct 23, 2018 - Affected: from 2.7.0a1, fixed in 2.7.1; from 2.6.0a1, fixed in 2.6.7; fixed in 2.5.11; from 2.7, fixed in 2.7.1; from 2.6, fixed in 2.6.7; fixed in 2.5.11. ### [CVE-2016-8614](https://cve.now/CVE-2016-8614): A flaw was found in Ansible before version 2.2.0. - Severity: Medium 6.3 - Published: Jul 31, 2018 - Affected: fixed in 2.2.0.0. ### [CVE-2016-8628](https://cve.now/CVE-2016-8628): Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. - Severity: High 7.6 - Published: Jul 31, 2018 - Affected: fixed in 2.2.0.0. ### [CVE-2016-8647](https://cve.now/CVE-2016-8647): An input validation vulnerability was found in Ansible's mysql\_user module before 2.2.1.0, which may fail to correctly change a password… - Severity: Low 2.2 - Published: Jul 26, 2018 - Affected: fixed in 2.2.1.0. ### [CVE-2017-7481](https://cve.now/CVE-2017-7481): Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. - Severity: Medium 5.3 - Published: Jul 19, 2018 - Affected: fixed in 2.3.1.0; from 2.3.2.0, fixed in 2.4.0.0; from 2.3.0.0, fixed in 2.3.1.0; fixed in 2.1.6.0; from 2.2.0.0, fixed in 2.2.3.0. ### [CVE-2018-10875](https://cve.now/CVE-2018-10875): A flaw was found in ansible. - Severity: High 7.8 - Published: Jul 13, 2018 - Affected: fixed in 2.4.6.0; from 2.5.0a1, fixed in 2.5.6; from 2.6.0a1, fixed in 2.6.1; from 2.5, fixed in 2.5.6; from 2.4, fixed in 2.4.6.0; from 2.6, fixed in 2.6.1. ### [CVE-2018-10855](https://cve.now/CVE-2018-10855): Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no\_log task flag for failed tasks. - Severity: Medium 5.9 - Published: Jul 2, 2018 - Affected: from 2.5.0a1, fixed in 2.5.5; from 2.4.0.0, fixed in 2.4.5.0; from 2.5, fixed in 2.5.5; from 2.4, fixed in 2.4.5.0. ### [CVE-2018-10874](https://cve.now/CVE-2018-10874): In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under… - Severity: High 7.8 - Published: Jul 2, 2018 - Affected: fixed in 2.4.6.0; from 2.5, fixed in 2.5.6; from 2.6, fixed in 2.6.1; fixed in 2.4.6.0; from 2.5, fixed in 2.5.6; from 2.6, fixed in 2.6.1. ### [CVE-2017-7466](https://cve.now/CVE-2017-7466): Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. - Severity: High 8.0 - Published: Jun 22, 2018 - Affected: fixed in 2.2.3.0; fixed in 2.3.0.0. ### [CVE-2013-2233](https://cve.now/CVE-2013-2233): Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys. - Severity: Unrated - Published: May 4, 2018 - Affected: fixed in 1.2.1. ### [CVE-2016-9587](https://cve.now/CVE-2016-9587): Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. - Severity: Medium 6.6 - Published: Apr 24, 2018 - Affected: fixed in 2.1.4.0; from 2.2.0.0, fixed in 2.2.1.0; fixed in 2.1.4.0; from 2.2.0.0, fixed in 2.2.1.0. ### [CVE-2017-7550](https://cve.now/CVE-2017-7550): A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins\_plugin module. - Severity: Unrated - Published: Nov 21, 2017 - Affected: from 2.4.0.0, fixed in 2.4.1.0; from 2.3.0.0, fixed in 2.3.3.0; from 2.3.0.0, fixed in 2.3.3.0; from 2.4.0.0, fixed in 2.4.1.0. ### [CVE-2014-3498](https://cve.now/CVE-2014-3498): The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands. - Severity: Unrated - Published: Jun 8, 2017 - Affected: fixed in 1.6.6; fixed in 1.6.6. ### [CVE-2015-6240](https://cve.now/CVE-2015-6240): The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink… - Severity: Unrated - Published: Jun 7, 2017 - Affected: fixed in 1.9.2; fixed in 1.9.2. ### [CVE-2016-3096](https://cve.now/CVE-2016-3096): The create\_script function in the lxc\_container module in Ansible before 1.9.6-1 and 2.x before 2.0.2.0 allows local users to write to… - Severity: Unrated - Published: Jun 3, 2016 - Affected: fixed in 2.0.2.0; from 2.0.0.0, fixed in 2.0.2.0; fixed in 1.9.6.1. ### [CVE-2015-3908](https://cve.now/CVE-2015-3908): Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName… - Severity: Unrated - Published: Aug 12, 2015 - Affected: fixed in 1.9.2. ### [CVE-2013-4260](https://cve.now/CVE-2013-4260): lib/ansible/playbook/init.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite… - Severity: Unrated - Published: Sep 16, 2013 - Affected: from 1.2, fixed in 1.2.3; from 1.2.0, fixed in 1.2.3. ### [CVE-2013-4259](https://cve.now/CVE-2013-4259): runner/connection\_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a… - Severity: Unrated - Published: Sep 16, 2013 - Affected: fixed in 1.2.3. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/ansible Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.