CVE-2018-10874 Ansible Improper Input Validation vulnerability

What is CVE-2018-10874?

CVE-2018-10874 is a high-severity code injection vulnerability in Redhat Openstack, published on 2 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

Weakness: CWE-20, CWE-426

Which versions are affected by CVE-2018-10874?

7 open source packages ship an affected version, including ansible. It affects 4 products.

Products include Redhat Ansible Engine, Redhat Openstack, Redhat Virtualization, Redhat Virtualization Host.

How do I fix CVE-2018-10874?

Upgrade ansible to a fixed version for your release line: 2.4.6.0, 2.5.6 or 2.6.1.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-10874 being exploited?

There is no known exploitation of CVE-2018-10874 in the wild and no public exploit code.

Other vulnerabilities in Redhat Openstack

• CVE-2020-1737 Path Traversal in Ansible High 7.5
• CVE-2020-1734 OS Command Injection in ansible High 7.4
• CVE-2019-14858 Ansible leaks sensitive information to logs when told not to High 7.3
• CVE-2020-10691 Path Traversal in Ansible Medium 5.2
• CVE-2018-16859 Ansible Logs Passwords If PowerShell ScriptBlock is Enabled Medium 4.2

All Redhat Openstack vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2018-10874, GHSA-3xvg-x47j-x75w, PYSEC-2018-81, UBUNTU-CVE-2018-10874.