CVE-2019-14904: 
Ansible vulnerability analysis and mitigation

A security vulnerability (CVE-2019-14904) was discovered in the solaris_zone module from the Ansible Community modules. The vulnerability was disclosed in August 2019 and affects Ansible Engine versions prior to 2.7.15, 2.8.7, and 2.9.2. The affected component is the solaris_zone module which is used for managing Solaris zones (NVD, Red Hat).

The vulnerability occurs when setting the name for the zone on the Solaris host. The module checks the zone name by listing the process with the 'ps' bare command on the remote machine without proper input validation. This implementation flaw allows for potential command injection through the zone name parameter. The vulnerability has been assigned a CVSS v3.1 base score of 7.3 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L (NVD).

If exploited, an attacker could take advantage of this flaw by crafting the name of the zone to execute arbitrary commands on the remote host. This could lead to unauthorized command execution in the context of the Ansible execution environment (Red Hat).

The vulnerability requires local access and high privileges to exploit. The attack complexity is low, and no user interaction is required for exploitation. The vulnerability has been confirmed to be exploitable through crafted zone names that can manipulate the module's behavior (GitHub PR).

The vulnerability has been fixed in Ansible Engine versions 2.7.15, 2.8.7, and 2.9.2. The fix includes implementing proper input validation for zone names according to Solaris Zone documentation. Users are advised to upgrade to these versions or later. For Debian users, fixes have been released in version 2.2.1.0-2+deb9u2 for Debian 9 (stretch) and 2.7.7+dfsg-1+deb10u1 for Debian 10 (buster) (Debian Advisory, Red Hat Advisory).