NetSight
IP …
critical9.8

CVE-2017-7481

Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe.

Impact

Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.

Affected products

VendorProductAffected versions
RedhatOpenshift Container Platform
Versions 3.3, 3.4, 3.5
RedhatOpenstack
Versions 10, 11
RedhatStorage Console
Version 2.0
RedhatVirtualization
Version 4.1
RedhatVirtualization Manager
Version 4.1
RedhatGluster Storage
Version 3.2
RedhatAnsible Engine
before 2.3.1.0
from 2.3.2.0 before 2.4.0.0
CanonicalUbuntu Linux
Versions 16.04, 18.04, 19.04
DebianDebian Linux
Version 9.0

Weakness classification

CWE-20

References