Red Hat Ansible CVE-2024-9902 Privilege Escalation via user module

Key Information Vulnerability Description Name: CVE-2024-9902 Public Disclosure Date: November 6, 2024 Last Updated: November 6, 2024, 7:35:34 PM UTC Impact Level Impact Level: Medium CVSS v3 Score: 6.3 Affected Scope Affected Packages and Red Hat Security Patches: - Ansible Automation Platform Execution Environments - Red Hat Ansible Automation Platform 2 - Red Hat OpenStack Platform 17.1 Vulnerability Details Description: The module in Ansible allows unauthorized users to create or replace files in the home directory of an unauthorized user, gaining ownership of those files, when a privileged user executes the module. If the unauthorized user has traversal permissions to the directory containing the targeted file, they retain full control over the file's contents. Mitigation Measures Recommendation: When using the module, ensure the following is executed in public tasks: - - Additional Information Bugzilla: 2318271 CWE: 863 FAQ: Frequently Asked Questions about CVE-2024-9902 CVSS v3 Analysis CVSS v3 Base Score: 6.3 Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality Impact: High Integrity Impact: High Availability Impact: Low Acknowledgments Thanks to: Matt Clay for reporting this issue. Frequently Asked Questions Why does Red Hat’s CVSS v3 score or impact differ from other vendors? My product is listed as “under investigation” or “affected”—when will Red Hat release a fix for this vulnerability? If my product is listed as “not fixed,” what should I do? If my product is listed as “fix delayed,” what should I do? What are mitigations? I have a Red Hat product, but it’s not listed above—am I affected? Why does my security scanner report this vulnerability on my product, even though my product version is patched or unaffected? Terminology Uncertain about the meaning of a term? Check our Security Glossary. Note This page is auto-generated and has not been checked for errors or omissions. For clarifications or corrections, contact Red Hat Product Security. Last updated: November 6, 2024, 7:35:34 PM UTC CVE description copyright © 2021

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat Ansible CVE-2024-9902 Privilege Escalation via user module

More from this source