Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by
    leveraging failure to cache SSH host keys. (CVE-2013-2233)

Ansible changelog reports :

Host key checking is on by default. Disable it if you like by adding host_key_checking=False in the [default] section of /etc/ansible/ansible.cfg or ~/ansible.cfg or by exporting ANSIBLE_HOST_KEY_CHECKING=False.

Upstream 1.2.2 version. See:
https://groups.google.com/forum/#!topic/ansible-project/Bj0TmfsExhk for more info.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
421952	SCA: security update for ansible (GHSA-9x6q-5423-w5v9)	Tenable Cloud Security	SCA Checks	critical
421952	SCA: security update for ansible (GHSA-9x6q-5423-w5v9)	Tenable Self-Hosted Container Security	SCA Checks	critical
84526	FreeBSD : ansible -- enable host key checking in paramiko connection type (a478421e-2059-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	high
68885	Fedora 17 : ansible-1.2.2-1.fc17 (2013-12400)	Nessus	Fedora Local Security Checks	high
68883	Fedora 18 : ansible-1.2.2-1.fc18 (2013-12394)	Nessus	Fedora Local Security Checks	high
68882	Fedora 19 : ansible-1.2.2-1.fc19 (2013-12389)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2013-2233

critical

Tenable Plugins

critical

critical

high

high

high

high