CVE-2019-14905 [Medium] | Input Validation Bypass in Ansible Engine

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-05-29	0.05%	0.27%	+0.22%
2	2025-08-23	0.05%	0.05%	+0.00%
3	2025-06-19	—	0.05%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-05-29

0.05%

0.27%

+0.22%

2025-08-23

0.05%

+0.00%

2025-06-19

—

0.05%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
5.6	3.1	MEDIUM	`CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:H) They need powerful rights—admin, root, or similar—before this pays off. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:L) Might cause slowdowns, glitches, or partial disruption—not a full brick.	0.8	4.7	[email protected]
7.3	3.0	HIGH	`CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:H) They need powerful rights—admin, root, or similar—before this pays off. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:C) Breaking this can reach past the original component and bite other resources—bigger blast radius. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:L) Attackers could change some data, but it’s limited—not everything goes. Availability (A:L) Might cause slowdowns, glitches, or partial disruption—not a full brick.	1.5	5.3	[email protected]
4.6	2.0	MEDIUM	`AV:L/AC:L/Au:N/C:P/I:P/A:P` Click to expand Access vector (AV:L) Requires local access to the target system. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:P) Partial confidentiality impact. Integrity impact (I:P) Partial integrity impact. Availability impact (A:P) Partial availability impact.	3.9	6.4	[email protected]

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

5.6

3.1

MEDIUM

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:H): They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:L): Might cause slowdowns, glitches, or partial disruption—not a full brick.

0.8

4.7

[email protected]

7.3

3.0

HIGH

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:H): They need powerful rights—admin, root, or similar—before this pays off.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:C): Breaking this can reach past the original component and bite other resources—bigger blast radius.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:L): Attackers could change some data, but it’s limited—not everything goes.
Availability (A:L): Might cause slowdowns, glitches, or partial disruption—not a full brick.

1.5

5.3

[email protected]

4.6

2.0

MEDIUM

AV:L/AC:L/Au:N/C:P/I:P/A:P Click to expand

Access vector (AV:L): Requires local access to the target system.
Access complexity (AC:L): Exploitation conditions are straightforward and predictable.
Authentication (AU:N): No authentication is required.
Confidentiality impact (C:P): Partial confidentiality impact.
Integrity impact (I:P): Partial integrity impact.
Availability impact (A:P): Partial availability impact.

3.9

6.4

[email protected]

Weakness enumeration for CVE-2019-14905

GitHub Security Advisory for CVE-2019-14905

GHSA-frxj-5j27-f8rf · Severity: high · Ecosystem: pip — Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible

OS Trackers for CVE-2019-14905

vendor	priority	summary	link
`alpine`	medium	CVE-2019-14905: 2 source package rows (ansible, ansible-base); 5 state rows across 5 repos (3.10-main, 3.11-main, 3.12-main, edge-community, edge-main); fixed 5, open 0.	https://security.alpinelinux.org/vuln/CVE-2019-14905
`debian`	low	CVE-2019-14905 low priority: Debian including 1 source packages (ansible), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2019-14905
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2019-14905
`suse`	high	CVE-2019-14905 severity important: SUSE including 121 source package names (ansible-10-10.6.0-1.1, ansible-11-11.11.0-1.1, …), 252 product×package rows across 10 product lines (HPE Helion OpenStack 8, SUSE Linux Enterprise Server 11 SP3-TERADATA, … (10 product lines)): Fixed 252.	https://www.suse.com/security/cve/CVE-2019-14905/
`ubuntu`	medium	CVE-2019-14905 medium priority: Ubuntu including 1 source packages (ansible), 18 status rows across 18 suites (bionic, disco, eoan, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): not-affected 14, ignored 2, needed 1, released 1.	https://ubuntu.com/security/CVE-2019-14905

Affected software / configurations for CVE-2019-14905

Vendor	Product	Version	Raw CPE
redhat	ansible_engine	>= 2.7.0, < 2.7.16	cpe:2.3:a:redhat:ansible_engine::::::::
redhat	ansible_engine	>= 2.8.0, < 2.8.8	cpe:2.3:a:redhat:ansible_engine::::::::
redhat	ansible_engine	>= 2.9.0, < 2.9.3	cpe:2.3:a:redhat:ansible_engine::::::::
redhat	ansible_tower	3.0.0	cpe:2.3:a:redhat:ansible_tower:3.0.0:::::::*
redhat	ceph_storage	3.0	cpe:2.3:a:redhat:ceph_storage:3.0:::::::*
redhat	cloudforms_management_engine	5.0	cpe:2.3:a:redhat:cloudforms_management_engine:5.0:::::::*
redhat	openstack	13	cpe:2.3:a:redhat:openstack:13:::::::*
fedoraproject	fedora	30	cpe:2.3:o:fedoraproject:fedora:30:::::::*
opensuse	backports_sle	15.0	cpe:2.3:a:opensuse:backports_sle:15.0:sp1::::::
opensuse	leap	15.1	cpe:2.3:o:opensuse:leap:15.1:::::::*

References for CVE-2019-14905

URL	Tags
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00021.html	Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00026.html	Mailing List Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0216	Patch Vendor Advisory
https://access.redhat.com/errata/RHSA-2020:0218	Patch Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14905	Issue Tracking Patch Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BNCYPQ4BY5QHBCJOAOPANB5FHATW2BR/

URL

CVE-2019-14905

Exploit prediction scoring system (EPSS) score for CVE-2019-14905

Common vulnerability scoring system (CVSS) metrics for CVE-2019-14905

Weakness enumeration for CVE-2019-14905

GitHub Security Advisory for CVE-2019-14905

OS Trackers for CVE-2019-14905

Affected software / configurations for CVE-2019-14905

References for CVE-2019-14905