⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.

CVE-2017-7481

CWE-20 — Improper Input Validation13 documents8 sources
Severity
9.8CRITICAL
EPSS
3.5%
top 12.38%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
10
Redhat Ansible Engine[unknown] AnsibleCanonical Ubuntu Linux+7 more
Timeline
PublishedJul 19
Latest updateJul 24

Description

Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages10 packages

▶PyPIansible2.3.0.0 — 2.3.1.0+2
▶NVDredhat/ansible_engine2.3.2.0 — 2.4.0.0+1
▶Debianansible< 2.3.1.0+dfsg-1+3
▶Ubuntuansible< 2.0.0.2-2ubuntu1.3+1
▶CVEListV5[unknown]/ansibleansible 2.3.1.0, ansible 2.4.0.0+1

Also affects: Debian Linux 9.0, Ubuntu Linux 16.04, 18.04, 19.04, Openshift Container Platform 3.3, 3.4, 3.5

Patches

Patch: bugzilla.redhat.com ↗Patch: github.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

5
OSV
ansible vulnerabilities↗2019-07-24
▶
OSV
Ansible fails to properly mark lookup-plugin results as unsafe↗2018-09-06
▶
GHSA
Ansible fails to properly mark lookup-plugin results as unsafe↗2018-09-06
▶
OSV
CVE-2017-7481: Ansible before versions 2↗2018-07-19
▶
CVEList
CVE-2017-7481: Ansible before versions 2↗2018-07-19
▶

📋Vendor Advisories

3
Ubuntu
Ansible vulnerabilities↗2019-07-24
▶
Red Hat
ansible: Security issue with lookup return not tainting the jinja2 environment↗2017-05-09
▶
Debian
CVE-2017-7481: ansible - Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin...↗2017
▶

💬Community

4
Bugzilla
Update Ansible to 2.3.1↗2017-06-15
▶
Bugzilla
CVE-2017-7481 ansible: Security issue with lookup return not tainting the jinja2 environment [epel-all]↗2017-05-12
▶
Bugzilla
CVE-2017-7481 ansible: Security issue with lookup return not tainting the jinja2 environment [fedora-all]↗2017-05-12
▶
Bugzilla
CVE-2017-7481 ansible: Security issue with lookup return not tainting the jinja2 environment↗2017-05-11
▶