CVE:CVE-2018-10875
CNNVD:CNNVD-201807-1158
Ansible是美国Ansible公司的一款计算机系统配置管理器，它可用于发布、管理和编排计算机系统。
Ansible中存在安全漏洞，该漏洞源于系统在运行ad-hoc命令时从当前工作目录加载inventory变量。本地攻击者可通过修改变量利用该漏洞执行任意代码。
solution:Upgrade redhat ansible_engine to a higher version than 2.0,2.4,2.5,2.6,and avoid the version 2.0,2.4,2.5,2.6; Upgrade redhat ceph_storage to a higher version than 2.0,3.0,and avoid the version 2.0,3.0; Upgrade redhat gluster_storage to a higher version than 3.0.0,and avoid the version 3.0.0; Upgrade redhat openshift to a higher version than 3.0,and avoid the version 3.0; Upgrade redhat openstack to a higher version than 10,12,13,and avoid the version 10,12,13; Upgrade redhat virtualization to a higher version than 4.0,and avoid the version 4.0; Upgrade redhat virtualization_host to a higher version than 4.0,and avoid the version 4.0; Upgrade debian debian_linux to a higher version than 9.0,8.0,and avoid the version 9.0,8.0; Upgrade suse package_hub to a higher version than -; Upgrade canonical ubuntu_linux to a higher version than 16.04,18.04,19.04,and avoid the version 16.04,18.04,19.04