GHSA-p62g-jhg6-v3rq Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible

• PyPI ansible: >= 2.7.0a1, < 2.7.17 → fixed in 2.7.17 • PyPI ansible: >= 2.8.0a1, < 2.8.11 → fixed in 2.8.11 • PyPI ansible: >= 2.9.0a1, < 2.9.7 → fixed in 2.9.7

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.11, and 2.9.7 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.