CVE-2019-14904

Name	CVE-2019-14904
Description	A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2535-1, DSA-4950-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ansible (PTS)	buster	2.7.7+dfsg-1+deb10u1	fixed
	buster (security)	2.7.7+dfsg-1+deb10u2	fixed
	bullseye	2.10.7+merged+base+2.10.8+dfsg-1	fixed
	bookworm	7.3.0+dfsg-1	fixed
	trixie	7.7.0+dfsg-3	fixed
	sid	9.5.1+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
ansible	source	jessie	(not affected)
ansible	source	stretch	2.2.1.0-2+deb9u2		DLA-2535-1
ansible	source	buster	2.7.7+dfsg-1+deb10u1		DSA-4950-1
ansible	source	(unstable)	2.9.4+dfsg-1	low

Notes

[jessie] - ansible <not-affected> (Vulnerable module first bundled in 2.0)
https://bugzilla.redhat.com/show_bug.cgi?id=1776944
https://github.com/ansible/ansible/pull/65686
https://github.com/ansible/ansible/blob/stable-2.0/CHANGELOG.md