5.5
Medium
CVE-2024-11079 Ansible-core: unsafe tagging bypass via hostvars object in ansible-core
Description
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:LExploitable remotely over the network, with an ordinary account and if a user takes an action; the impact on data or service is limited.
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- Interaction
- Required
- Scope
- Changed
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ansible Automation Platform Execution Environments 2.15 | earliest → < 2.15.13-4 | 2.15.13-4 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Versions not published | |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux AI (RHEL AI) | Versions not published | |
| Red Hat In-Vehicle Operating System 1 | Versions not published |
References
- RHSA-2024:10770 access.redhat.com
- RHSA-2024:11145 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2325171 bugzilla.redhat.com
Timeline
- Published
- Last modified