Red Hat Ansible Runner vulnerabilities

3 CVEs affecting Red Hat Ansible Runner, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-4041, published 2022-08-24.

More from Red Hat.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-4041, published 2022-08-24. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command.…
• CVE-2021-3701, published 2022-08-23. Medium severity, CVSS 6.6. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory,…
• CVE-2021-3702, published 2022-08-23. Medium severity, CVSS 6.3. EPSS: 0.2% chance of exploitation in the next 30 days. A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have…