ansible: ansible.cfg is being read from current working directory allowing possible code execution
Published Jul 13, 2018
8.5
HIGHCVSS 4.0
EPSS 0.59%
Description
A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.
Affected products
- Vendor n/a Product Ansible Defaultn/a
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||
|---|---|---|---|---|---|---|
| n/a | Ansible | n/a |
|
Configuration 1
- 2.0
- 2.4
- 2.5
- 2.6
- 2.0
- 3.0
- 3.0.0
- 3.0
- 10
- 12
- 13
- 4.0
- 4.0
Configuration 2
- 9.0
Configuration 3
- n/a
Running on/with
- 12
Configuration 4
- 16.04
- 18.04
- 19.04
- 8.0
No data.
Red Hat Ansible Engine 2 for RHEL 7
ansible-0:2.6.1-1.el7ae
Fixed · RHSA-2018:2151
Red Hat Ansible Engine 2.4 for RHEL 7
ansible-0:2.4.6.0-1.el7ae
Fixed · RHSA-2018:2152
Red Hat Ansible Engine 2.5 for RHEL 7
ansible-0:2.5.6-1.el7ae
Fixed · RHSA-2018:2150
Red Hat Ansible Engine 2.6 for RHEL 7
ansible-0:2.6.1-1.el7ae
Fixed · RHSA-2018:2166
Red Hat OpenStack Platform 10.0 (Newton)
ansible-0:2.4.6.0-1.el7ae
Fixed · RHSA-2019:0054
Red Hat OpenStack Platform 12.0 (Pike)
ansible-0:2.4.6.0-1.el7ae
Fixed · RHBA-2018:3788
Red Hat OpenStack Platform 12.0 (Pike)
ansible-role-redhat-subscription-0:1.0.1-4.el7ost
Fixed · RHBA-2018:3788
Red Hat OpenStack Platform 13.0 (Queens)
ansible-0:2.4.6.0-1.el7ae
Fixed · RHSA-2018:2585
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
imgbased-0:1.0.22-1.el7ev
Fixed · RHSA-2018:2321
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
redhat-release-virtualization-host-0:4.2-5.0.el7
Fixed · RHSA-2018:2321
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
redhat-virtualization-host-0:4.2-20180724.0
Fixed · RHSA-2018:2321
CloudForms Management Engine 5
ansible
Not affected
Red Hat Ceph Storage 2
ansible
Will not fix
Red Hat Ceph Storage 3
ansible
Will not fix
Red Hat OpenShift Enterprise 3
ansible
Will not fix
Red Hat OpenStack Platform 14 (Rocky)
ansible
Not affected
Red Hat Satellite 6
ansible
Not affected
Red Hat Storage 3
ansible
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Ansible Engine 2 for RHEL 7 | ansible-0:2.6.1-1.el7ae | Fixed | RHSA-2018:2151 |
| Red Hat Ansible Engine 2.4 for RHEL 7 | ansible-0:2.4.6.0-1.el7ae | Fixed | RHSA-2018:2152 |
| Red Hat Ansible Engine 2.5 for RHEL 7 | ansible-0:2.5.6-1.el7ae | Fixed | RHSA-2018:2150 |
| Red Hat Ansible Engine 2.6 for RHEL 7 | ansible-0:2.6.1-1.el7ae | Fixed | RHSA-2018:2166 |
| Red Hat OpenStack Platform 10.0 (Newton) | ansible-0:2.4.6.0-1.el7ae | Fixed | RHSA-2019:0054 |
| Red Hat OpenStack Platform 12.0 (Pike) | ansible-0:2.4.6.0-1.el7ae | Fixed | RHBA-2018:3788 |
| Red Hat OpenStack Platform 12.0 (Pike) | ansible-role-redhat-subscription-0:1.0.1-4.el7ost | Fixed | RHBA-2018:3788 |
| Red Hat OpenStack Platform 13.0 (Queens) | ansible-0:2.4.6.0-1.el7ae | Fixed | RHSA-2018:2585 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | imgbased-0:1.0.22-1.el7ev | Fixed | RHSA-2018:2321 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | redhat-release-virtualization-host-0:4.2-5.0.el7 | Fixed | RHSA-2018:2321 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | redhat-virtualization-host-0:4.2-20180724.0 | Fixed | RHSA-2018:2321 |
| CloudForms Management Engine 5 | ansible | Not affected | n/a |
| Red Hat Ceph Storage 2 | ansible | Will not fix | n/a |
| Red Hat Ceph Storage 3 | ansible | Will not fix | n/a |
| Red Hat OpenShift Enterprise 3 | ansible | Will not fix | n/a |
| Red Hat OpenStack Platform 14 (Rocky) | ansible | Not affected | n/a |
| Red Hat Satellite 6 | ansible | Not affected | n/a |
| Red Hat Storage 3 | ansible | Will not fix | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
Red Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository.
Metrics
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L/AC:L/Au:N/C:P/I:P/A:P
This CVE is not in the KEV list.
No CISA SSVC assessment for this CVE yet.
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.
Score over time
2021–2026- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Percentile over time
- EPSS v1
- EPSS v2
- EPSS v3
- EPSS v4
- EPSS v5
Table of values (14 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 1, 2026 | 0.59% (0.00592) | 46.34th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.59% (0.00587) | 43.26th | v5 (v2026.06.15) |
| Mar 17, 2025 | 0.24% (0.00245) | 45.91th | v4 (v2025.03.14) |
| Dec 12, 2024 | 0.08% (0.00078) | 35.34th | v3 (v2023.03.01) |
| Jul 7, 2023 | 0.08% (0.00078) | 32.00th | v3 (v2023.03.01) |
| Mar 7, 2023 | 0.06% (0.00056) | 21.34th | v3 (v2023.03.01) |
| Mar 6, 2023 | 1.86% (0.01864) | 77.24th | v2 (v2022.01.01) |
| Feb 23, 2023 | 1.86% (0.01864) | 77.19th | v2 (v2022.01.01) |
| Apr 1, 2022 | 1.86% (0.01864) | 75.17th | v2 (v2022.01.01) |
| Feb 4, 2022 | 1.86% (0.01864) | 54.47th | v2 (v2022.01.01) |
| Feb 3, 2022 | 5.30% (0.05304) | 78.84th | v1 |
| Jan 6, 2022 | 5.30% (0.05304) | 78.63th | v1 |
| Sep 1, 2021 | 5.30% (0.05304) | 88.21th | v1 |
| Apr 14, 2021 | 5.30% (0.05304) | 0.00th | v1 |
References (27)
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html vendor-advisoryx_refsource_SUSEThird Party Advisory
- http://www.securitytracker.com/id/1041396 vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHBA-2018:3788 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2150 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2151 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2152 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2166 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2321 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:2585 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:0054 vendor-advisoryx_refsource_REDHATThird Party Advisory
- https://access.redhat.com/security/cve/CVE-2018-10875 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1596533 Issue Tracking
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10875 x_refsource_CONFIRMIssue TrackingThird Party Advisory
- https://github.com/advisories/GHSA-fc4h-467w-46rh Advisory
- https://github.com/ansible/ansible/commit/4cecbe81adbc655d7ab734165d3ac539f8ba5981
- https://github.com/ansible/ansible/commit/f32c42c37aaf7b9db93ea3151b2f42a0c4bd8172
- https://github.com/ansible/ansible/commit/ff980afefdbe4ceb828bdb1bb2eef03cf616bf63
- https://github.com/ansible/ansible/issues/42388
- https://github.com/ansible/ansible/pull/42070
- https://github.com/ansible/ansible/pull/43583
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-43.yaml
- https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html mailing-listx_refsource_MLISTThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2018-10875
- https://usn.ubuntu.com/4072-1 vendor-advisoryx_refsource_UBUNTUThird Party Advisory
- https://web.archive.org/web/20201130165946/http://www.securitytracker.com/id/1041396
- https://www.cve.org/CVERecord?id=CVE-2018-10875
- https://www.debian.org/security/2019/dsa-4396 vendor-advisoryx_refsource_DEBIANThird Party Advisory
Change history (0)
No recorded changes yet.