cbcvebase.
CVE-2014-4657
published 2020-02-20

CVE-2014-4657: The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted…

PriorityP357critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.39%
90.2th percentile
The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.

Affected

18 ranges
VendorProductVersion rangeFixed in
debianansible< ansible 1.5.5+dfsg-1 (bookworm)ansible 1.5.5+dfsg-1 (bookworm)
debianansible< ansible 1.6.6+dfsg-1 (bookworm)ansible 1.6.6+dfsg-1 (bookworm)
debiandebian_linux——
debiandebian_linux——
debiandebian_linux——
redhatansible< 1.5.41.5.4
redhatansible< 1.6.41.6.4
redhatansible——
redhatansible>= 0 < 1.6.6+dfsg-11.6.6+dfsg-1
redhatansible>= 0 < 1.5.5+dfsg-11.5.5+dfsg-1
redhatansible>= 0 < 1.6.6+dfsg-11.6.6+dfsg-1
redhatansible>= 0 < 1.5.5+dfsg-11.5.5+dfsg-1
redhatansible>= 0 < 1.6.6+dfsg-11.6.6+dfsg-1
redhatansible>= 0 < 1.5.5+dfsg-11.5.5+dfsg-1
redhatansible>= 0 < 1.6.6+dfsg-11.6.6+dfsg-1
redhatansible>= 0 < 1.5.5+dfsg-11.5.5+dfsg-1
redhatansible>= 0 < 1.5.41.5.4
redhatansible>= 0 < 1.6.41.6.4

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
ghsa9.8CRITICAL
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.