CVE-2018-10875: Untrusted Search Path

July 13, 2018 (updated July 25, 2019)

A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under the control of an attacker, thus allowing the attacker to execute arbitrary code.

References

www.securitytracker.com/id/1041396
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10875
nvd.nist.gov/vuln/detail/CVE-2018-10875

Code Behaviors & Features

Detect and mitigate CVE-2018-10875 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →