Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HRed Hat Ansible
APPRedhat< 1.6.7
Related vulnerabilities
The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote...
The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote...
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent r...
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to ...
A template injection flaw was found in Ansible where a user's controller internal templating operations may re...