CVE-2021-3583
published 2021-09-22CVE-2021-3583: A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user…
PriorityP434high7.1CVSS 3.1
AVLACLPRLUINSUCHIHAN
EPSS
0.89%
55.3th percentile
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ansible | < ansible 5.4.0-1 (bookworm) | ansible 5.4.0-1 (bookworm) |
| debian | ansible-core | < ansible 5.4.0-1 (bookworm) | ansible 5.4.0-1 (bookworm) |
| msrc | cbl2_ansible_2.12.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cm1_ansible_2.9.23-1_on_cbl_mariner_1.0 | — | — |
| redhat | ansible | >= 0 < 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1 | 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1 |
| redhat | ansible | >= 0 < 5.4.0-1 | 5.4.0-1 |
| redhat | ansible | >= 0 < 5.4.0-1 | 5.4.0-1 |
| redhat | ansible | >= 0 < 5.4.0-1 | 5.4.0-1 |
| redhat | ansible | >= 0 < 2.9.23rc1 | 2.9.23rc1 |
| redhat | ansible | >= 0 < 2.0.0.2-2ubuntu1.3+esm1 | 2.0.0.2-2ubuntu1.3+esm1 |
| redhat | ansible | >= 0 < 2.5.1+dfsg-1ubuntu0.1+esm1 | 2.5.1+dfsg-1ubuntu0.1+esm1 |
| redhat | ansible | >= 0 < 2.9.6+dfsg-1ubuntu0.1~esm1 | 2.9.6+dfsg-1ubuntu0.1~esm1 |
| redhat | ansible | >= 0 < 2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm1 | 2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm1 |
| redhat | ansible | >= 2.10.0a1 < 2.10.11rc1 | 2.10.11rc1 |
| redhat | ansible | >= 2.11.0a1 < 2.11.2rc1 | 2.11.2rc1 |
| redhat | ansible_automation_platform | — | — |
| redhat | ansible_automation_platform | — | — |
| redhat | ansible_engine | < 2.9.23 | 2.9.23 |
| redhat | ansible_tower | < 3.7.0 | 3.7.0 |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv2.03.6LOWAV:L/AC:L/Au:N/C:P/I:P/A:N
osv7.1HIGH
vendor_debian7.1HIGH
vendor_msrc7.1HIGH
vendor_redhat7.1HIGH
vendor_ubuntu5.0MEDIUM
vendor_cisco3.1
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
ansible vulnerabilities
osv·2022-06-07·CVSS 5.0
CVE-2020-1733 [MEDIUM] ansible vulnerabilities
ansible vulnerabilities
It was discovered that Ansible did not properly manage directory
permissions when running playbooks with an unprivileged become user. A
local attacker could possibly use this issue to cause a race condition,
escalate privileges and execute arbitrary code. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-1733)
It was discovered that the fix to address CVE-2020-1733 in Ansible was
incomplete on systems using ACLs and FUSE filesystems. A local attacker
could possibly use this issue to cause a race condition, escalate
privileges and execute arbitrary code. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-10744)
It was discovered that Ansible did not properly manage multi-line YAML
s
GHSA
Improper Input Validation and Command Injection in Ansible
ghsa·2021-09-23
CVE-2021-3583 [HIGH] CWE-20 Improper Input Validation and Command Injection in Ansible
Improper Input Validation and Command Injection in Ansible
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
OSV
Improper Input Validation and Command Injection in Ansible
osv·2021-09-23
CVE-2021-3583 [HIGH] Improper Input Validation and Command Injection in Ansible
Improper Input Validation and Command Injection in Ansible
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
OSV
CVE-2021-3583: A flaw was found in Ansible, where a user's controller is vulnerable to template injection
osv·2021-09-22·CVSS 7.1
CVE-2021-3583 [HIGH] CVE-2021-3583: A flaw was found in Ansible, where a user's controller is vulnerable to template injection
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
Ubuntu
Ansible vulnerabilities
vendor_ubuntu·2022-06-07·CVSS 5.0
CVE-2020-10744 [MEDIUM] Ansible vulnerabilities
Title: Ansible vulnerabilities
Summary: Several security issues were fixed in Ansible.
It was discovered that Ansible did not properly manage directory
permissions when running playbooks with an unprivileged become user. A
local attacker could possibly use this issue to cause a race condition,
escalate privileges and execute arbitrary code. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-1733)
It was discovered that the fix to address CVE-2020-1733 in Ansible was
incomplete on systems using ACLs and FUSE filesystems. A local attacker
could possibly use this issue to cause a race condition, escalate
privileges and execute arbitrary code. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-10744)
It was d
Microsoft
A flaw was found in Ansible where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line
vendor_msrc·2021-09-14·CVSS 7.1
CVE-2021-3583 [HIGH] CWE-94 A flaw was found in Ansible where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line
A flaw was found in Ansible where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open s
Red Hat
ansible: Template Injection through yaml multi-line strings with ansible facts used in template.
vendor_redhat·2021-06-08·CVSS 7.1
CVE-2021-3583 [HIGH] CWE-20 ansible: Template Injection through yaml multi-line strings with ansible facts used in template.
ansible: Template Injection through yaml multi-line strings with ansible facts used in template.
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts b
Debian
CVE-2021-3583: ansible - A flaw was found in Ansible, where a user's controller is vulnerable to template...
vendor_debian·2021·CVSS 7.1
CVE-2021-3583 [HIGH] CVE-2021-3583: ansible - A flaw was found in Ansible, where a user's controller is vulnerable to template...
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
Scope: local
bookworm: resolved (fixed in 5.4.0-1)
bullseye: resolved (fixed in 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1)
forky: resolved (fixed in 5.4.0-1)
sid: resolved (fixed in 5.4.0-1)
trixie: resolved (fixed in 5.4.0-1)
Cisco
Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2020-3583 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
CVE-2020-3583: Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Web Services Interface Cross-Site Scripting Vulnerabilities
Update June 28, 2021 : Cisco has become aware that public exploit code exists for CVE-2020-3580, and this vulnerability is being actively exploited. Multiple vulnerabilities in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the web services interface of an affected device. The vulnerabilities are due to insufficient validation of user-supplied input by the web services interface of an affected device. An attacker could exploit these vulnerabiliti
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-09-22
Published