CVE-2016-9587

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 17.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-04-24 · updated 2026-06-17
Weakness: CWE-20

Description

Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

Affected products

Ansible: before 2.2.1 — fixed in 2.2.1
Red Hat Ansible: before 2.1.4 — fixed in 2.1.4
OpenStack: 11

How to fix

Upgrade to a fixed version: Ansible 2.2.1; Red Hat Ansible 2.1.4. Check the vendor advisory for mitigations.

References

http://rhn.redhat.com/errata/RHSA-2017-0195.html
http://rhn.redhat.com/errata/RHSA-2017-0260.html
http://www.securityfocus.com/bid/95352
https://access.redhat.com/errata/RHSA-2017:0448
https://access.redhat.com/errata/RHSA-2017:0515
https://access.redhat.com/errata/RHSA-2017:1685
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9587
https://security.gentoo.org/glsa/201701-77
https://www.exploit-db.com/exploits/41013/
http://rhn.redhat.com/errata/RHSA-2017-0195.html
http://rhn.redhat.com/errata/RHSA-2017-0260.html
http://www.securityfocus.com/bid/95352

Get alerted when CVE-2016-9587 or the next vulnerability affects your stack