5.3
Medium
CVE-2017-7481 Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe
Description
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| ansible | Versions not published |
Other CVEs of ansible
The 7 CVEs of ansible →
CVE-2019-14856
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
6.4
Medium
CVE-2018-16837
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen
7.8
High
CVE-2018-10875
A flaw was found in ansible
7.8
High
CVE-2018-10855
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks
5.9
Medium