CVE-2019-14905

Severity: medium (CVSS 5.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-31 · updated 2026-06-17
Weakness: CWE-20

Description

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

Affected products

Fedoraproject Fedora: 30
openSUSE Backports Sle: 15.0-sp1
openSUSE Leap: 15.1
RedHat Ansible Engine: from 2.7.0 before 2.7.16; from 2.8.0 before 2.8.8; from 2.9.0 before 2.9.3 — fixed in 2.7.16, 2.8.8, 2.9.3
Tower: 3.0.0
Red Hat Ceph Storage: 3.0
Red Hat CloudForms: 5.0
OpenStack: 13

How to fix

Upgrade to a fixed version: RedHat Ansible Engine 2.7.16, 2.8.8, 2.9.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-14905 or the next vulnerability affects your stack