{"id":"CVE-2017-7481","published":"2018-07-19T13:00:00Z","modified":"2024-08-05T16:04:11Z","title":"Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe","vendor":null,"product":"ansible","tier":"tail","description":{"text":"Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.04782,"percentile":0.91927,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:1599","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7481","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1334","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/98492","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1244","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1499","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2524","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1476","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://usn.ubuntu.com/4072-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":22.1,"factors":[{"name":"EPSS percentile","points":18.39},{"name":"CVSS severity","points":3.71}]},"affectedVersions":[{"vendor":"[UNKNOWN]","product":"ansible","versions":["ansible 2.3.1.0","ansible 2.4.0.0"]}],"affected":[{"ecosystem":"PyPI","package":"ansible","vulnerableRanges":[">=2.3.0.0, <2.3.1.0","<2.1.6.0",">=2.2.0.0, <2.2.3.0","<2.3.1.0",">=2.3.2.0, <2.4.0.0"],"patched":["2.3.1.0","2.1.6.0","2.2.3.0","2.4.0.0"],"from":["GHSA-w578-j992-554x","PYSEC-2018-41"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0014","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2016-8614","published":"2018-07-31","fixed":"2.2.0.0","kev":false,"link":{"from":"CVE-2017-7481","to":"CVE-2016-8614","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.1.6.0","toFixed":"2.2.0.0","daysApart":12}]}},{"cve":"CVE-2016-8628","published":"2018-07-31","fixed":"2.2.0.0","kev":false,"link":{"from":"CVE-2017-7481","to":"CVE-2016-8628","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.1.6.0","toFixed":"2.2.0.0","daysApart":12}]}},{"cve":"CVE-2016-8647","published":"2018-07-26","fixed":"2.2.1.0","kev":false,"link":{"from":"CVE-2016-8647","to":"CVE-2017-7481","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.2.1.0","toFixed":"2.2.3.0","daysApart":-7}]}},{"cve":"CVE-2016-9587","published":"2018-04-24","fixed":"2.2.1.0","kev":false,"link":{"from":"CVE-2016-9587","to":"CVE-2017-7481","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.1.4.0","toFixed":"2.1.6.0","daysApart":86}]}},{"cve":"CVE-2017-7466","published":"2018-06-22","fixed":"2.3.0.0","kev":false,"link":{"from":"CVE-2017-7466","to":"CVE-2017-7481","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.3.0.0","toFixed":"2.3.1.0","daysApart":27}]}},{"cve":"CVE-2017-7481","published":"2018-07-19","fixed":"2.4.0.0","kev":false},{"cve":"CVE-2017-7550","published":"2017-11-21","fixed":"2.4.1.0","kev":false,"link":{"from":"CVE-2017-7550","to":"CVE-2017-7481","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.3.3.0","toFixed":"2.4.0.0","daysApart":240}]}},{"cve":"CVE-2018-10855","published":"2018-07-02","fixed":"2.5.5","kev":false},{"cve":"CVE-2018-10874","published":"2018-07-02","fixed":"2.6.1","kev":false}],"package":"PyPI:ansible"}}