CVE-2019-14905

Name	CVE-2019-14905
Description	A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ansible (PTS)	buster, buster (security)	2.7.7+dfsg-1+deb10u1	vulnerable
	bullseye	2.10.7+merged+base+2.10.8+dfsg-1	fixed
	bookworm	7.3.0+dfsg-1	fixed
	sid, trixie	7.7.0+dfsg-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
ansible	source	jessie	(not affected)
ansible	source	(unstable)	2.9.4+dfsg-1	low

Notes

[buster] - ansible <no-dsa> (Minor issue)
[stretch] - ansible <no-dsa> (Minor issue)
[jessie] - ansible <not-affected> (Vulnerable module first bundled in 2.2)
https://bugzilla.redhat.com/show_bug.cgi?id=1776943
https://github.com/ansible/ansible/pull/65423
https://github.com/ansible/ansible/blob/stable-2.2/CHANGELOG.md