CVE-2015-6240
HIGH severity · CVSS 7.8 · CWE-59
7.8CVSS HIGH
Summary
The chroot, jail, and zone connection plugins in ansible before 1.9.2 allow local users to escape a restricted environment via a symlink attack.
Impact & exploitability
Attack vectorLocal
Attack complexityLow
Privileges requiredLow
User interactionNone
Confidentiality impactHigh
Integrity impactHigh
Availability impactHigh
Exploit probability (EPSS)0%
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products we track (1)
Recommendation
Apply the vendor fix promptly. Open any affected product above for its exact safe version.
Official patch: https://github.com/ansible/ansible/commit/952166f48eb0f5797b75b160fd156bbe1e8fc647 ↗
Additional information
- NVD record
- https://github.com/ansible/ansible/commit/952166f48eb0f5797b75b160fd156bbe1e8fc647Patch
- https://github.com/ansible/ansible/commit/ca2f2c4ebd7b5e097eab0a710f79c1f63badf95bPatch
- http://www.openwall.com/lists/oss-security/2015/08/17/10Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1243468Advisory
- https://lists.debian.org/debian-lts-announce/2019/09/msg00016.html