7.8

CVE-2018-10874

In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Ansible Engine Version2.0
Redhat ≫ Ansible Engine Version2.4
Redhat ≫ Ansible Engine Version2.5
Redhat ≫ Ansible Engine Version2.6
Redhat ≫ Openstack Version10
Redhat ≫ Openstack Version12
Redhat ≫ Openstack Version13
Redhat ≫ Virtualization Version4.0
Redhat ≫ Virtualization Host Version4.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.49% 0.379
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.6 3.9 6.4
AV:L/AC:L/Au:N/C:P/I:P/A:P
secalert@redhat.com 7.8 1.8 5.9
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-426 Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

http://www.securitytracker.com/id/1041396
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHBA-2018:3788
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2150
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2151
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2152
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2166
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2321
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:2585
Vendor Advisory
https://access.redhat.com/errata/RHSA-2019:0054
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10874
Vendor Advisory
Issue Tracking
https://usn.ubuntu.com/4072-1/