Improper input validation in [Unknown] Ansible
CVE-2017-7481
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.048 (91.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- [Unknown] Ansible — versions ansible 2.4.0.0, ansible 2.3.1.0
- Canonical Ubuntu_linux — versions 16.04, 18.04, 19.04
- Debian Debian_linux — versions 9.0
- Redhat Ansible_engine
- Redhat Enterprise_linux — versions 7.0
- Redhat Gluster_storage — versions 3.2
- Redhat Openshift_container_platform — versions 3.3, 3.4, 3.5
- Redhat Openstack — versions 10, 11
- Redhat Storage_console — versions 2.0
- Redhat Virtualization — versions 4.1
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Issue Tracking, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
- secalert@redhat.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- secalert@redhat.com (x_refsource_CONFIRM, Patch, Third Party Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_UBUNTU, vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2017-7481?
- CVE-2017-7481 is a critical-severity vulnerability in [Unknown] Ansible, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2018-07-19.
- How severe is CVE-2017-7481?
- Critical severity. CVSS v3 base score is 9.8 out of 10.