CVE-2013-4259: Ansible uses a socket with predictable filename in /tmp

May 14, 2022 (updated August 28, 2023)

runner/connection_plugins/ssh.py in Ansible before 1.2.3, when using ControlPersist, allows local users to redirect a ssh session via a symlink attack on a socket file with a predictable name in /tmp/.

References

www.ansible.com/security
bugzilla.redhat.com/show_bug.cgi?id=998223
github.com/advisories/GHSA-fj24-ghp9-39v3
groups.google.com/forum/
groups.google.com/forum/
nvd.nist.gov/vuln/detail/CVE-2013-4259

Code Behaviors & Features

Detect and mitigate CVE-2013-4259 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →