Test ID:	1.3.6.1.4.1.25623.1.1.10.2020.0060
Category:	Mageia Linux Local Security Checks
Title:	Mageia: Security Advisory (MGASA-2020-0060)
Summary:	The remote host is missing an update for the 'ansible' package(s) announced via the MGASA-2020-0060 advisory.
Description:	Summary: The remote host is missing an update for the 'ansible' package(s) announced via the MGASA-2020-0060 advisory. Vulnerability Insight: A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host (CVE-2019-14904). A vulnerability in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues (CVE-2019-14905). Affected Software/OS: 'ansible' package(s) on Mageia 7. Solution: Please install the updated package(s). CVSS Score: 6.1 CVSS Vector: AV:L/AC:L/Au:N/C:C/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-14904 Debian Security Information: DSA-4950 (Google Search) https://www.debian.org/security/2021/dsa-4950 https://bugzilla.redhat.com/show_bug.cgi?id=1776944 https://github.com/ansible/ansible/pull/65686 https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html Common Vulnerability Exposure (CVE) ID: CVE-2019-14905 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5BNCYPQ4BY5QHBCJOAOPANB5FHATW2BR/ RedHat Security Advisories: RHSA-2020:0216 https://access.redhat.com/errata/RHSA-2020:0216 RedHat Security Advisories: RHSA-2020:0218 https://access.redhat.com/errata/RHSA-2020:0218 SuSE Security Announcement: openSUSE-SU-2020:0513 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html SuSE Security Announcement: openSUSE-SU-2020:0523 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.