CVE-2015-6240

Published: Jun 7, 2017Modified: May 13, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.

Affected (1)

Products: Redhat: Ansible

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Ansible	Up to 1.9.1

Related CWEs

Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References (10)

http://www.openwall.com/lists/oss-security/2015/08/17/10

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1243468

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://github.com/ansible/ansible/commit/952166f48eb0f5797b75b160fd156bbe1e8fc647

Source: cve@mitre.org

Patch

https://github.com/ansible/ansible/commit/ca2f2c4ebd7b5e097eab0a710f79c1f63badf95b

Source: cve@mitre.org

Patch

https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2015/08/17/10

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1243468

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

https://github.com/ansible/ansible/commit/952166f48eb0f5797b75b160fd156bbe1e8fc647

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/ansible/ansible/commit/ca2f2c4ebd7b5e097eab0a710f79c1f63badf95b

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.