GitHub Advisoryadvisory · PyPI
GHSA-99w6-3xph-cx78 Ansible-Core vulnerable to content protections bypass
LOW
Official page ↗
- Aliases
- CVE-2024-11079
- Ecosystem
- PyPI
- Packages
- ansible-core
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
- Weaknesses
- CWE-20
- Reviewed
- 2024-11-12
Affected packages
• PyPI ansible-core: >= 2.18.0b1, < 2.18.1rc1 → fixed in 2.18.1rc1
• PyPI ansible-core: >= 2.17.0b1, < 2.17.7rc1 → fixed in 2.17.7rc1
• PyPI ansible-core: < 2.16.14rc1 → fixed in 2.16.14rc1
Description
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
Related
Alias · CVE (1)
- CVE-2024-11079 A flaw was found in Ansible-Core. vulnerability
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-11079 advisory
- https://github.com/ansible/ansible/pull/84299 web
- https://github.com/ansible/ansible/pull/84339 web
- https://github.com/ansible/ansible/commit/2936b80dbbc7efb889934aeec80f6142c10266ce web
- https://github.com/ansible/ansible/commit/70e83e72b43e05e57eb42a6d52d01a4d9768f510 web
- https://github.com/ansible/ansible/commit/98774d15d7748ebaaaf2e83942cc7e8d39f7280e web
- https://access.redhat.com/errata/RHSA-2024:10770 web
- https://access.redhat.com/errata/RHSA-2024:11145 web
- https://access.redhat.com/security/cve/CVE-2024-11079 web
- https://bugzilla.redhat.com/show_bug.cgi?id=2325171 web
- https://github.com/ansible/ansible package
- https://github.com/ansible/ansible/blob/v2.18.1/changelogs/CHANGELOG-v2.18.rst#security-fixes web
- https://lists.debian.org/debian-lts-announce/2026/03/msg00006.html web