CVE-2019-14905: Fedoraproject Fedora

Medium severity, CVSS 5.6. EPSS: 0.7% chance of exploitation in the next 30 days.

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

Affected products

• Fedoraproject Fedora: version 30 only
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.1 only
• Red Hat Ansible Engine: from 2.7.0, before 2.7.16 (fixed in 2.7.16); from 2.8.0, before 2.8.8 (fixed in 2.8.8); from 2.9.0, before 2.9.3 (fixed in 2.9.3)
• Red Hat Ansible Tower: version 3.0.0 only
• Red Hat Ceph Storage: version 3.0 only
• Red Hat Cloudforms Management Engine: version 5.0 only
• Red Hat Openstack: version 13 only

Published 2020-03-31. Last modified 2026-06-17.