CVE-2017-7481 Ansible fails to properly mark lookup-plugin results as unsafe
CriticalCVSS 9.8
EPSS 4.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi ansible(PyPI) | >= 2.3.0.0, < 2.3.1.0 | 2.3.1.0 |
| pypi ansible(PyPI) | = 2.3.0.0 | No fix listed |
| pypi ansible(PyPI) | < 2.1.6.0 | 2.1.6.0 |
| pypi ansible(PyPI) | = 1.0 | No fix listed |
| pypi ansible(PyPI) | = 1.1 | No fix listed |
| pypi ansible(PyPI) | = 1.2 | No fix listed |
| pypi ansible(PyPI) | = 1.2.1 | No fix listed |
| pypi ansible(PyPI) | = 1.2.2 | No fix listed |
| pypi ansible(PyPI) | = 1.2.3 | No fix listed |
| pypi ansible(PyPI) | = 1.3.0 | No fix listed |
| pypi ansible(PyPI) | = 1.3.1 | No fix listed |
| pypi ansible(PyPI) | = 1.3.2 | No fix listed |
| pypi ansible(PyPI) | = 1.3.3 | No fix listed |
| pypi ansible(PyPI) | = 1.3.4 | No fix listed |
| pypi ansible(PyPI) | = 1.4 | No fix listed |
| pypi ansible(PyPI) | = 1.4.1 | No fix listed |
| pypi ansible(PyPI) | = 1.4.2 | No fix listed |
| pypi ansible(PyPI) | = 1.4.3 | No fix listed |
| pypi ansible(PyPI) | = 1.4.4 | No fix listed |
| pypi ansible(PyPI) | = 1.4.5 | No fix listed |
| pypi ansible(PyPI) | = 1.5 | No fix listed |
| pypi ansible(PyPI) | = 1.5.1 | No fix listed |
| pypi ansible(PyPI) | = 1.5.2 | No fix listed |
| pypi ansible(PyPI) | = 1.5.3 | No fix listed |
| pypi ansible(PyPI) | = 1.5.4 | No fix listed |
Show 70 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi ansible(PyPI) | = 1.5.5 | No fix listed |
| pypi ansible(PyPI) | = 1.6 | No fix listed |
| pypi ansible(PyPI) | = 1.6.1 | No fix listed |
| pypi ansible(PyPI) | = 1.6.10 | No fix listed |
| pypi ansible(PyPI) | = 1.6.2 | No fix listed |
| pypi ansible(PyPI) | = 1.6.3 | No fix listed |
| pypi ansible(PyPI) | = 1.6.4 | No fix listed |
| pypi ansible(PyPI) | = 1.6.5 | No fix listed |
| pypi ansible(PyPI) | = 1.6.6 | No fix listed |
| pypi ansible(PyPI) | = 1.6.7 | No fix listed |
| pypi ansible(PyPI) | = 1.6.8 | No fix listed |
| pypi ansible(PyPI) | = 1.6.9 | No fix listed |
| pypi ansible(PyPI) | = 1.7 | No fix listed |
| pypi ansible(PyPI) | = 1.7.1 | No fix listed |
| pypi ansible(PyPI) | = 1.7.2 | No fix listed |
| pypi ansible(PyPI) | = 1.8 | No fix listed |
| pypi ansible(PyPI) | = 1.8.1 | No fix listed |
| pypi ansible(PyPI) | = 1.8.2 | No fix listed |
| pypi ansible(PyPI) | = 1.8.3 | No fix listed |
| pypi ansible(PyPI) | = 1.8.4 | No fix listed |
| pypi ansible(PyPI) | = 1.9.0 | No fix listed |
| pypi ansible(PyPI) | = 1.9.0.1 | No fix listed |
| pypi ansible(PyPI) | = 1.9.1 | No fix listed |
| pypi ansible(PyPI) | = 1.9.2 | No fix listed |
| pypi ansible(PyPI) | = 1.9.3 | No fix listed |
| pypi ansible(PyPI) | = 1.9.4 | No fix listed |
| pypi ansible(PyPI) | = 1.9.5 | No fix listed |
| pypi ansible(PyPI) | = 1.9.6 | No fix listed |
| pypi ansible(PyPI) | = 2.0.0 | No fix listed |
| pypi ansible(PyPI) | = 2.0.0.0 | No fix listed |
| pypi ansible(PyPI) | = 2.0.0.1 | No fix listed |
| pypi ansible(PyPI) | = 2.0.0.2 | No fix listed |
| pypi ansible(PyPI) | = 2.0.1.0 | No fix listed |
| pypi ansible(PyPI) | = 2.0.2.0 | No fix listed |
| pypi ansible(PyPI) | = 2.1.0.0 | No fix listed |
| pypi ansible(PyPI) | = 2.1.1.0 | No fix listed |
| pypi ansible(PyPI) | = 2.1.2.0 | No fix listed |
| pypi ansible(PyPI) | = 2.1.3.0 | No fix listed |
| pypi ansible(PyPI) | = 2.1.4.0 | No fix listed |
| pypi ansible(PyPI) | = 2.1.5.0 | No fix listed |
| pypi ansible(PyPI) | >= 2.2.0.0, < 2.2.3.0 | 2.2.3.0 |
| pypi ansible(PyPI) | = 2.2.0.0 | No fix listed |
| pypi ansible(PyPI) | = 2.2.1.0 | No fix listed |
| pypi ansible(PyPI) | = 2.2.2.0 | No fix listed |
| pypi ansible(PyPI) | < 2.3.1.0 | 2.3.1.0 |
| pypi ansible(PyPI) | >= 2.3.2.0, < 2.4.0.0 | 2.4.0.0 |
| pypi ansible(PyPI) | = 2.1.6.0 | No fix listed |
| pypi ansible(PyPI) | = 2.2.3.0 | No fix listed |
| pypi ansible(PyPI) | = 2.3.2.0 | No fix listed |
| pypi ansible(PyPI) | = 2.3.3.0 | No fix listed |
| debian/ansible(Debian:12) | < 2.3.1.0+dfsg-1 | 2.3.1.0+dfsg-1 |
| debian/ansible(Debian:13) | < 2.3.1.0+dfsg-1 | 2.3.1.0+dfsg-1 |
| debian/ansible(Debian:14) | < 2.3.1.0+dfsg-1 | 2.3.1.0+dfsg-1 |
| redhat openshift container platform | = 3.3 | No fix listed |
| redhat openshift container platform | = 3.4 | No fix listed |
| redhat openshift container platform | = 3.5 | No fix listed |
| redhat openstack | = 10 | No fix listed |
| redhat openstack | = 11 | No fix listed |
| redhat storage console | = 2.0 | No fix listed |
| redhat virtualization | = 4.1 | No fix listed |
| redhat virtualization manager | = 4.1 | No fix listed |
| redhat gluster storage | = 3.2 | No fix listed |
| redhat ansible engine | < 2.3.1.0 | 2.3.1.0 |
| redhat ansible engine | >= 2.3.2.0, < 2.4.0.0 | 2.4.0.0 |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| Canonical Ubuntu Linux | = 19.04 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| [UNKNOWN] ansible | = ansible 2.3.1.0 | No fix listed |
| [UNKNOWN] ansible | = ansible 2.4.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch third-party-advisory
- github.com patch
- web.archive.org
- USN-4072-1 third-party-advisory vendor-advisory
- [debian-lts-announce] 20210127 [SECURITY] [DLA 2535-1] ansible security update mailing-list third-party-advisory
- github.com
- github.com product
- bugzilla.redhat.com issue-tracking patch vendor-advisory
- RHSA-2017:2524 vendor-advisory
- RHSA-2017:1599 vendor-advisory
- RHSA-2017:1499 vendor-advisory
- RHSA-2017:1476 vendor-advisory
- RHSA-2017:1334 vendor-advisory
- RHSA-2017:1244 vendor-advisory
- 98492 third-party-advisory vdb-entry
- github.com vendor-advisory
- Debian Security Tracker CVE-2017-7481 vendor-advisory
- bugs.debian.org issue-tracking