Patchfirst
Patchfirst
Chain[UNKNOWN] · ansiblePyPI:ansible

[UNKNOWN] ansible: successive fixes (2016–2019)

6 CVEs over 3 generations, 24 Apr 2018 to 26 Nov 2019.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2016-958724 Apr 2018 First in the chain
  2. CVE-2017-746622 Jun 2018 next fix after CVE-2016-9587
  3. CVE-2018-108742 Jul 2018 No direct link to an earlier CVE
  4. CVE-2019-1015630 Jul 2019 related to CVE-2017-7466
  5. CVE-2019-1020622 Nov 2019 related to CVE-2018-10874next fix after CVE-2019-10156
  6. CVE-2019-1485626 Nov 2019 related to CVE-2019-10206related to CVE-2017-7466and 1 more
Apr 2018JulOctJul 2019Oct CVE-2019-10206 → CVE-2019-14856: related (high confidence)CVE-2016-9587 → CVE-2017-7466: Next fix in the same package (medium confidence)CVE-2017-7466 → CVE-2019-10156: related (medium confidence)CVE-2017-7466 → CVE-2019-14856: related (medium confidence)CVE-2018-10874 → CVE-2019-10206: related (medium confidence)CVE-2018-10874 → CVE-2019-14856: related (medium confidence)CVE-2019-10156 → CVE-2019-10206: Next fix in the same package (low confidence) CVE-2016-9587 24 Apr 2018 CVE-2017-7466 22 Jun 2018 CVE-2018-10874 2 Jul 2018 CVE-2019-10156 30 Jul 2019 CVE-2019-10206 22 Nov 2019 CVE-2019-14856 26 Nov 2019 Apr 2018JulOctJan 2019AprJulOct CVE-2019-10206 → CVE-2019-14856: related (high confidence)CVE-2016-9587 → CVE-2017-7466: Next fix in the same package (medium confidence)CVE-2017-7466 → CVE-2019-10156: related (medium confidence)CVE-2017-7466 → CVE-2019-14856: related (medium confidence)CVE-2018-10874 → CVE-2019-10206: related (medium confidence)CVE-2018-10874 → CVE-2019-14856: related (medium confidence)CVE-2019-10156 → CVE-2019-10206: Next fix in the same package (low confidence) CVE-2016-9587 24 Apr 2018 CVE-2017-7466 22 Jun 2018 CVE-2018-10874 2 Jul 2018 CVE-2019-10156 30 Jul 2019 CVE-2019-10206 22 Nov 2019 CVE-2019-14856 26 Nov 2019
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2016-9587 24 Apr 2018 Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent… · fixed in 2.2.1.0 First in chain 29.0
CVE-2017-7466 22 Jun 2018 Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems · fixed in 2.3.0.0 CVE-2016-9587 · Next fix in the same package · Medium 23.1
CVE-2018-10874 2 Jul 2018 In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command… · fixed in 2.6.1 First in chain 13.9
CVE-2019-10156 30 Jul 2019 A flaw was discovered in the way Ansible templating was implemented in versions before 2.6.18, 2.7.12 and 2.8.2… · fixed in 2.8.2 CVE-2017-7466 · related · Medium 18.9
CVE-2019-10206 22 Nov 2019 ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x… · fixed in 2.8.4 CVE-2018-10874 · related · Medium 19.4
CVE-2019-14856 26 Nov 2019 ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None · fixed in 2.8.6 CVE-2019-10206 · related · High 19.8
↑ ↓ chooseEnter openEsc close