GitHub Advisoryadvisory · PyPI

GHSA-6j58-grhv-2769 ansible-runner vulnerable to shell command injection

HIGH Published 2022-08-25 Modified 2024-09-03 Official page ↗

Aliases: CVE-2021-4041
Ecosystem: PyPI
Packages: ansible-runner
Severity: High
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses: CWE-116, CWE-20
Reviewed: 2022-09-01

Affected packages

• PyPI ansible-runner: < 2.1.0 → fixed in 2.1.0

Description

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the `ansible_runner.interface.run_command`, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.

Alias · CVE (1)

CVE-2021-4041 A flaw was found in ansible-runner. vulnerability

Weakness · CWE (2)

CWE-116 Improper Encoding or Escaping of Output weakness
CWE-20 Improper Input Validation weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2021-4041 advisory
https://github.com/ansible/ansible-runner/commit/3533f265f4349a3f2a0283158cd01b59a6bbc7bd web
https://access.redhat.com/security/cve/CVE-2021-4041 web
https://bugzilla.redhat.com/show_bug.cgi?id=2028074 web
https://github.com/advisories/GHSA-6j58-grhv-2769 advisory
https://github.com/ansible/ansible-runner package
https://github.com/pypa/advisory-database/tree/main/vulns/ansible-runner/PYSEC-2022-253.yaml web