CVE-2018-1104 Code injection in Ansible Tower

High 8.8 Published 2 May 2018 Updated 16 Sep 2024

Users with job template variable access can execute arbitrary code on the Ansible Tower server, requiring an upgrade to mitigate.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-1104?

CVE-2018-1104 is a high-severity code injection vulnerability in Redhat Ansible Tower, published on 2 May 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Ansible Tower through version 3.2.3 has a vulnerability that allows users only with access to define variables for a job template to execute arbitrary code on the Tower server.

Weakness: CWE-94, CWE-20

Which versions are affected by CVE-2018-1104?

It affects 2 products.

Products include Redhat Ansible Tower, Redhat Cloudforms.

How do I fix CVE-2018-1104?

Upgrade to a fixed version.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-1104 being exploited?

There is no known exploitation of CVE-2018-1104 in the wild and no public exploit code.

All Redhat Ansible Tower vulnerabilities

Sources

Also known as GHSA-4839-8mxx-4xr9.