GitHub Advisoryadvisory · PyPI

GHSA-7j69-qfc3-2fq9 Ansible template injection vulnerability

MEDIUM Published 2023-12-13 Modified 2024-09-16 Official page ↗
Aliases
CVE-2023-5764
Ecosystem
PyPI
Packages
ansible-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Weaknesses
CWE-1336
Reviewed
2023-12-20

Affected packages

• PyPI ansible-core: >= 2.16.0, < 2.16.1 → fixed in 2.16.1 • PyPI ansible-core: >= 2.15.0, < 2.15.8 → fixed in 2.15.8 • PyPI ansible-core: < 2.14.12 → fixed in 2.14.12

Description

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.

Related

Alias · CVE (1)

  • CVE-2023-5764 A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation… vulnerability

Weakness · CWE (1)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness

References