Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Ansible before 1.9.2 does not verify that the server hostname matches a domain name in the subject's
    Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle
    attackers to spoof SSL servers via an arbitrary valid certificate. (CVE-2015-3908)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7330-1 advisory.

    It was discovered that Ansible did not properly verify certain fields of X.509 certificates. An attacker     could possibly use this issue to spoof SSL servers if they were able to intercept network communications.
    This issue only affected Ubuntu 14.04 LTS. (CVE-2015-3908)

    Martin Carpenter discovered that certain connection plugins for Ansible did not properly restrict users.
    An attacker with local access could possibly use this issue to escape a restricted environment via     symbolic links misuse. This issue only affected Ubuntu 14.04 LTS. (CVE-2015-6240)

    Robin Schneider discovered that Ansible's apt_key module did not properly verify key fingerprints. A     remote attacker could possibly use this issue to perform key injection, leading to the access of sensitive     information. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8614)

    It was discovered that Ansible would expose passwords in certain instances. An attacker could possibly use     specially crafted input related to this issue to access sensitive information. This issue only affected     Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-10206)

    It was discovered that Ansible incorrectly logged sensitive information. An attacker with local access     could possibly use this issue to access sensitive information. This issue only affected Ubuntu 14.04 LTS,     Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. (CVE-2019-14846)

    It was discovered that Ansible's solaris_zone module accepted input without performing input checking. A     remote attacker could possibly use this issue to enable the execution of arbitrary code. This issue only     affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2019-14904)

    It was discovered that Ansible did not generate sufficiently random values, which could lead to the     exposure of passwords. An attacker could possibly use this issue to access sensitive information. This     issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2020-10729)

    It was discovered that Ansible's svn module could disclose passwords to users within the same node. An     attacker could possibly use this issue to access sensitive information. (CVE-2020-1739)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Several vulnerabilities were discovered in Ansible, a configuration management, deployment, and task execution system.

CVE-2015-3908

A potential man-in-the-middle attack associated with insusfficient X.509 certificate verification. Ansible did not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2015-6240

A symlink attack that allows local users to escape a restricted environment (chroot or jail) via a symlink attack.

CVE-2018-10875

A fix potential arbitrary code execution resulting from reading ansible.cfg from a world-writable current working directory. This condition now causes ansible to emit a warning and ignore the ansible.cfg in the world-writable current working directory.

CVE-2019-10156

Information disclosure through unexpected variable substitution.

For Debian 8 'Jessie', these problems have been fixed in version 1.7.2+dfsg-2+deb8u2.

We recommend that you upgrade your ansible packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix CVE-2015-3908 to remove tabs and use spaces instead.
    This broke python parsing and in consequence Ansible.
    (bnc #941863)

ansible was updated to fix one security issue.

This security issue was fixed :

  - CVE-2015-3908: Fixed improper TLS Certificate Validation     (bsc#938161).

Ansible, Inc. reports :

Ensure that hostnames match certificate names when using HTTPS - resolved in Ansible 1.9.2

Improper symlink handling in zone, jail, and chroot connection plugins could lead to escape from confined environment - resolved in Ansible 1.9.2

ID	Name	Product	Family	Severity
422617	SCA: security update for ansible (GHSA-w64c-pxjj-h866)	Tenable Cloud Security	SCA Checks	high
422617	SCA: security update for ansible (GHSA-w64c-pxjj-h866)	Tenable Self-Hosted Container Security	SCA Checks	high
232217	Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS : Ansible vulnerabilities (USN-7330-1)	Nessus	Ubuntu Local Security Checks	high
128881	Debian DLA-1923-1 : ansible security update	Nessus	Debian Local Security Checks	high
85701	openSUSE Security Update : ansible (openSUSE-2015-557)	Nessus	SuSE Local Security Checks	medium
84999	openSUSE Security Update : ansible (openSUSE-2015-508)	Nessus	SuSE Local Security Checks	medium
84523	FreeBSD : ansible -- multiple vulnerabilities (72fccfdf-2061-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2015-3908

high

Tenable Plugins

high

high

high

high

medium

medium

high