Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 18/02/2020 Updated: 26/02/2020

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Ansible prior to 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote malicious users to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.

Vulnerable Product	Search on Vulmon	Subscribe to Product
redhat ansible

Ansible Changes By Release 21 TBD - ACTIVE DEVELOPMENT ####New Modules: cloudstack: cs_volume ####New Filters: extract 201 "Over the Hills and Far Away" Fixes a major compatibility break in the synchronize module shipped with 200x That version of synchronize ran sudo on the controller prior to running rsync In 19x and previous, sudo was run on the hos

CWE-74 https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527 http://www.ocert.org/advisories/ocert-2014-004.html https://nvd.nist.gov https://github.com/clhlc/ansible-2.0

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2014-4966

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect