GitHub Advisoryadvisory · PyPI

GHSA-64cw-m57j-65xj Ansible Arbitrary Code Execution

CRITICAL Published 2022-05-17 Modified 2024-09-10 Official page ↗
Aliases
CVE-2014-4967
Ecosystem
PyPI
Packages
ansible
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2024-01-30

Affected packages

• PyPI ansible: < 1.6.7 → fixed in 1.6.7

Description

Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command.

Related

Alias · CVE (1)

  • CVE-2014-4967 Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References