CVE-2019-14904: OS Command Injection and Improper Input Validation in ansible
7.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.13916%
CWE
Published
4/20/2021
Updated
9/6/2024
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ansible | pip | >= 0, < 2.7.16 | 2.7.16 |
| ansible | pip | >= 2.8.0a1, < 2.8.8 | 2.8.8 |
| ansible | pip | >= 2.9.0a1, < 2.9.3 | 2.9.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from improper input validation in the solaris_zone module. The patch adds a regex validation check for the 'name' parameter in the SolarisZone.init method, confirming this was the missing safeguard. Prior to the fix, arbitrary zone names could include shell metacharacters, which were then passed to 'ps' commands (e.g., during zone status checks), leading to command injection. The init method is the logical point where input validation should occur, and its absence directly enabled the exploit.