← Back

CVE-2019-14905

nvd nist
Published: Mar 31, 2020Modified: Jun 17, 2026

JSON object

Loading...
5.6
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
Exploitability: 0.8 / Impact: 4.7
Source: NVD

Description

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

Affected (10)

Redhat
5 products
Ansible Engine
Ansible Tower
Ceph Storage
Cloudforms Management Engine
Openstack
Fedoraproject
1 product
Fedora
Opensuse
2 products
Backports Sle
Leap
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Redhat
Ansible Engine
From 2.7.0 to 2.7.16
Ansible Engine
From 2.8.0 to 2.8.8
Ansible Engine
From 2.9.0 to 2.9.3
Configuration B
4 vulnerable
Vulnerable SoftwareAffected Versions
Ansible Tower
Version 3.0.0
Ceph Storage
Version 3.0
Cloudforms Management Engine
Version 5.0
Openstack
Version 13
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Fedora
Version 30
Configuration D
2 vulnerable
Vulnerable SoftwareAffected Versions
Backports Sle
Version 15.0 sp1
Leap
Version 15.1

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-668
Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CWE-73
External Control of File Name or Path
The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (12)

Source: secalert@redhat.com
Mailing ListThird Party Advisory
Source: secalert@redhat.com
Mailing ListThird Party Advisory
Source: secalert@redhat.com
PatchVendor Advisory
Source: secalert@redhat.com
PatchVendor Advisory
Source: secalert@redhat.com
Issue TrackingPatchVendor Advisory
Source: secalert@redhat.com
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.