CVE-2019-14905: Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible
(updated )
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible’s nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.
References
- access.redhat.com/errata/RHSA-2020:0216
- access.redhat.com/errata/RHSA-2020:0218
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14905
- github.com/advisories/GHSA-frxj-5j27-f8rf
- github.com/ansible/ansible
- github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-206.yaml
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5BNCYPQ4BY5QHBCJOAOPANB5FHATW2BR
- nvd.nist.gov/vuln/detail/CVE-2019-14905
Code Behaviors & Features
Detect and mitigate CVE-2019-14905 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →