Ansible fails to cache SSH host keys

published 2018-05-04 8 y ago modified 2026-06-16 4 mo ago also GHSA-9x6q-5423-w5v9 , PYSEC-2018-36 , EUVD-2018-0009

cvss: 7.4; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.9%; EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits: 0; none known

Ansible before 1.2.1 makes it easier for remote attackers to conduct man-in-the-middle attacks by leveraging failure to cache SSH host keys.

Patch / fix

fixed in 2 distros 2

pypi ansible 1.2.1
redhat ansible 1.2.1

debian ubuntu

ansible Debian 14, Debian 13, Debian 12 1.3.4+dfsg-1

debian advisories DEBIAN-CVE-2013-2233

ansible Ubuntu 14.04 LTS 1.5.4+dfsg-1

ubuntu advisories UBUNTU-CVE-2013-2233

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-2233 updated 2025-11-21 cvss 5.8

ansible: Does not cache SSH host keys (preventing possibility of server's host key to be checked against system host keys)

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.90% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	7.4	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD	2.0	5.8	AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub	3.0	7.4	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	ansible	<1.2.1	1.2.1

Classification

Weakness

CWE-320 Key Management Errors

References

ansible.com /security
web, vendor-advisory
bugzilla.redhat.com /show_bug.cgi?id=980821
web, issue-tracking, report
github.com /ansible/ansible/issues/857
web, issue-tracking, third-party-advisory, report
openwall.com /lists/oss-security/2013/07/01/2
mailing-list, web, third-party-advisory
openwall.com /lists/oss-security/2013/07/02/6
mailing-list, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2013-2233
advisory
github.com /advisories/GHSA-9x6q-5423-w5v9
advisory
github.com /ansible/ansible
package
github.com /pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-36.yaml
web

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary