5.3
Moyenne
CVE-2017-7481 Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe
Description
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| ansible | Versions non publiées |
Autres CVE de ansible
Les 7 CVE de ansible →
CVE-2019-14856
ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
6.4
Moyenne
CVE-2018-16837
Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen
7.8
Élevée
CVE-2018-10875
A flaw was found in ansible
7.8
Élevée
CVE-2018-10855
Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks
5.9
Moyenne