CVE-2016-9587

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

Ansible before versions 2.1.4, 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
unspecified	Ansible	ansible 2.1.4; ansible 2.2.1

References

http://rhn.redhat.com/errata/RHSA-2017-0195.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0260.htmlThird Party Advisory
http://www.securityfocus.com/bid/95352Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:0448Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:0515Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1685Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9587Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/201701-77Third Party Advisory
https://www.exploit-db.com/exploits/41013/Exploit, Third Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2017-0195.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0260.htmlThird Party Advisory
http://www.securityfocus.com/bid/95352Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:0448Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:0515Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:1685Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-9587Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/201701-77Third Party Advisory
https://www.exploit-db.com/exploits/41013/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Apr 24, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-95885.5arch/x86/kvm/vmx.c in the Linux kernel through 4.9 mismanages the #BP and #OF exceptions, which allows guest OS users to cause a denial of s CVE-2016-95897.5Undertow in Red Hat wildfly before version 11.0.0.Beta1 is vulnerable to a resource exhaustion resulting in a denial of service. Undertow ke CVE-2016-95906.5puppet-swift before versions 8.2.1, 9.4.4 is vulnerable to an information-disclosure in Red Hat OpenStack Platform director's installation o CVE-2016-95915.5JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on t CVE-2016-95924.3openshift before versions 3.3.1.11, 3.2.1.23, 3.4 is vulnerable to a flaw when a volume fails to detach, which causes the delete operation t CVE-2016-95938.8foreman-debug before version 1.15.0 is vulnerable to a flaw in foreman-debug's logging. An attacker with access to the foreman log file woul CVE-2016-95948.1curl before version 7.52.1 is vulnerable to an uninitialized random in libcurl's internal function that returns a good 32bit random value. CVE-2016-95955.5A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit CVE-2016-95966.5libxml2, as used in Red Hat JBoss Core Services and when in recovery mode, allows context-dependent attackers to cause a denial of service (CVE-2016-95977.5It was found that Red Hat JBoss Core Services erratum RHSA-2016:2957 for CVE-2016-3705 did not actually include the fix for the issue found CVE-2016-95986.5libxml2, as used in Red Hat JBoss Core Services, allows context-dependent attackers to cause a denial of service (out-of-bounds read and app CVE-2016-95997.5puppet-tripleo before versions 5.5.0, 6.2.0 is vulnerable to an access-control flaw in the IPtables rules management, which allowed the crea