CVEvulnerability
CVE-2024-11079
5.5 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2024-11-12
- Last modified
- 2026-06-30
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 5.5 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
- Weaknesses
- CWE-20
Description
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://access.redhat.com/errata/RHSA-2024:10770 access.redhat.com
- https://access.redhat.com/errata/RHSA-2024:11145 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2024-11079 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2325171 bugzilla.redhat.com
- https://lists.debian.org/debian-lts-announce/2026/03/msg00006.html lists.debian.org