CVE-2016-8647 Improper Input Validation in ansible

What is CVE-2016-8647?

CVE-2016-8647 is a low-severity vulnerability in Redhat Virtualization, published on 26 Jul 2018. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An input validation vulnerability was found in Ansible's mysql_user module before 2.2.1.0, which may fail to correctly change a password in certain circumstances. Thus the previous password would still be active when it should have been changed.

Weakness: CWE-20

Which versions are affected by CVE-2016-8647?

3 open source packages ship an affected version, including ansible. It affects 2 products.

Products include Redhat Ansible Engine, Redhat Virtualization.

How do I fix CVE-2016-8647?

Upgrade ansible to 2.2.1.0 or later.

Is CVE-2016-8647 being exploited?

There is no known exploitation of CVE-2016-8647 in the wild and no public exploit code.

Other vulnerabilities in Redhat Virtualization

• CVE-2018-10874 Ansible Improper Input Validation vulnerability High 7.8
• CVE-2020-1737 Path Traversal in Ansible High 7.5
• CVE-2020-1734 OS Command Injection in ansible High 7.4
• CVE-2019-14858 Ansible leaks sensitive information to logs when told not to High 7.3
• CVE-2020-10691 Path Traversal in Ansible Medium 5.2

All Redhat Virtualization vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2016-8647, GHSA-x4cm-m36h-c6qj, PYSEC-2018-58.