GitHub Advisoryadvisory · PyPI

GHSA-wqq5-c89p-3wc3 Ansible Arbitrary Code Execution

CRITICAL Published 2022-05-17 Modified 2024-09-10 Official page ↗
Aliases
CVE-2014-4966
Ecosystem
PyPI
Packages
ansible
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2024-01-30

Affected packages

• PyPI ansible: < 1.6.7 → fixed in 1.6.7

Description

Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.

Related

Alias · CVE (1)

  • CVE-2014-4966 Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{"… vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References