CVE-2013-4259 Ansible uses a socket with predictable filename in /tmp

What is CVE-2013-4259?

CVE-2013-4259 is a low-severity path traversal vulnerability in n/a, published on 16 Sep 2013. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.

Weakness: CWE-264

Which versions are affected by CVE-2013-4259?

3 open source packages ship an affected version, including ansible. It affects 1 product.

Products include Redhat Ansible.

How do I fix CVE-2013-4259?

Upgrade ansible to 1.2.3 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2013-4259 being exploited?

There is no known exploitation of CVE-2013-4259 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2014-4657 Ansible Remote Code Execution Critical 9.8
• CVE-2014-4966 Ansible Arbitrary Code Execution Critical 9.8
• CVE-2014-4967 Ansible Arbitrary Code Execution Critical 9.8
• CVE-2017-7550 Ansible Insertion of Sensitive Information into Log File vulnerability Critical 9.8
• CVE-2014-3498 Ansible Arbitrary Code Execution High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2013-4259, GHSA-fj24-ghp9-39v3, PYSEC-2013-1.