CVE-2019-14904

Advisory

A vulnerability in versions of the Ansible solaris_zone module permits an attacker to execute arbitrary commands on a Solaris host. This issue arises when the module checks the zone name by using a basic 'ps' command, enabling the attack through a maliciously crafted zone name. This flaw poses a risk to various versions of Ansible Engine, exposing systems to potential unauthorized command execution.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://pypi.org/project/ansible
• https://data.safetycli.com/changelogs/ansible/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14904
• https://github.com/ansible/ansible/pull/65686