| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| ansible | ≥ 2.7.0, < 2.7.17≥ 2.7.0a1, < 2.7.17≥ 2.8.0, < 2.8.9≥ 2.8.0a1, < 2.8.11≥ 2.9.0, < 2.9.6≥ 2.9.0a1, < 2.9.7 | 2.7.172.8.92.8.112.9.62.9.7 |
| ansible | ≥ 2.7.0, < 2.7.17≥ 2.8.0, < 2.8.9≥ 2.9.0, < 2.9.6 | 2.7.172.8.92.9.6 |
| ansible tower | ≥ 3.5.0, ≤ 3.5.5≥ 3.6.0, ≤ 3.6.3≤ 3.3.5 | |
| openstack | = 10= 13 |
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.11, and 2.9.7 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí