CVE-2013-2233: Ansible fails to cache SSH host keys

October 10, 2018 (updated November 18, 2024)

Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.

References

bugzilla.redhat.com/show_bug.cgi?id=980821
github.com/advisories/GHSA-9x6q-5423-w5v9
github.com/ansible/ansible
github.com/ansible/ansible/issues/857
github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-36.yaml
nvd.nist.gov/vuln/detail/CVE-2013-2233
www.ansible.com/security

Code Behaviors & Features

Detect and mitigate CVE-2013-2233 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →