Log in Start free

Vulnerability · Published Nov 6, 2024 · Assigned by redhat

CVE-2024-9902Ansible-core: ansible-core user may read/write unauthorized content

Medium 6.3

In plain English

A medium-severity incorrect authorization in ansible-core. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.3Medium
Exploit odds (30 days)0.3%top 82.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ansible5.4.0-1DEBIAN-CVE-2024-9902
Debian:13ansible5.4.0-1DEBIAN-CVE-2024-9902
Debian:14ansible5.4.0-1DEBIAN-CVE-2024-9902
Debian:12ansible-core2.14.18-0+deb12u1DEBIAN-CVE-2024-9902
Debian:13ansible-core2.18.0-1DEBIAN-CVE-2024-9902
Debian:14ansible-core2.18.0-1DEBIAN-CVE-2024-9902
PyPIansible-core2.18.0rc2GHSA-32p4-gm2c-wmch
PyPIansible-core2.14.18rc1GHSA-32p4-gm2c-wmch
PyPIansible-core2.15.13rc1GHSA-32p4-gm2c-wmch
PyPIansible-core2.16.13rc1GHSA-32p4-gm2c-wmch
PyPIansible-core2.17.6rc1GHSA-32p4-gm2c-wmch
PyPIansible-core2.14.18rc1, 2.15.13rc1, 2.16.13rc1, 2.17.6rc1, 2.18.0rc2PYSEC-2026-1121
Ubuntu:24.04:LTSansibleno fix listedUBUNTU-CVE-2024-9902
Ubuntu:25.10ansibleno fix listedUBUNTU-CVE-2024-9902
Ubuntu:26.04:LTSansibleno fix listedUBUNTU-CVE-2024-9902
Ubuntu:26.10ansibleno fix listedUBUNTU-CVE-2024-9902
Ubuntu:22.04:LTSansible-coreno fix listedUBUNTU-CVE-2024-9902
Ubuntu:24.04:LTSansible-coreno fix listedUBUNTU-CVE-2024-9902
Ubuntu:25.10ansible-coreno fix listedUBUNTU-CVE-2024-9902
Ubuntu:26.04:LTSansible-coreno fix listedUBUNTU-CVE-2024-9902
Ubuntu:26.10ansible-coreno fix listedUBUNTU-CVE-2024-9902

Affected products (as reported)

VendorProductVersions
ansible-core 0 – before 2.14.18rc12.15.0b1 – before 2.15.13rc12.16.0b1 – before 2.16.13rc12.17.0b1 – before 2.17.6rc12.18.0b1 – before 2.18.0rc2
Red Hat Ansible Automation Platform Execution Environments see references
Red Hat Ansible Automation Platform Execution Environments see references
Red Hat Ansible Automation Platform Execution Environments see references
Red Hat Ansible Automation Platform Execution Environments see references
Red Hat Ansible Automation Platform Execution Environments see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.4 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 see references
Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 see references
Red Hat Red Hat OpenStack Platform 17.1 for RHEL 9 see references
Red Hat Red Hat Enterprise Linux 10 see references

Weakness: CWE-863 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L

References