Iniciar sesión
Deutsch English Español Polski
Crítica

Ansible fails to properly mark lookup-plugin results as unsafe

  • Publicada: 19.07.2018
  • Actualizado: 11.10.2026 12:19

Ansible before versions 2.1.6.0, 2.2.3.0, 2.3.1.0, and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Python (PyPI) ansible >= 2.3.0.0, < 2.3.1.0, < 2.1.6.0, >= 2.2.0.0, < 2.2.3.0 2.3.1.0, 2.1.6.0, 2.2.3.0

Referencias

Puntuación CVSS 9.8/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Debilidad (CWE)
CWE-20
Plataforma
Python (PyPI)
Paquete
ansible
Publicada
19.07.2018
Actualizado
11.10.2026 12:19

Fuentes y licencias

OSV / GitHub Advisory Database - PYSEC-2018-41 - PyPA Advisory Database; CC BY 4.0

OSV / GitHub Advisory Database - GHSA-w578-j992-554x - CC BY 4.0

Historial de vulnerabilidades: ansible

Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (68) en el archivo
Entradas en total
68
Primera → última
09.2013 12.2025
Sin corrección
2
Explotada en ataques
0

Distribución por gravedad

  • Crítica 9
  • Alta 24
  • Media 27
  • Baja 6
  • Sin evaluar 2

Divulgaciones por año

antes: 4

Gravedad:
  1. Ansible fails to properly mark lookup-plugin results as unsafe esta entrada
    Crítica · 9.8 CVE-2017-7481 >= 2.3.0.0, < 2.3.1.0, < 2.1.6.0, >= 2.2.0.0, < 2.2.3.0 2.3.1.0, 2.1.6.0, 2.2.3.0
  2. Ansible leaks password to logs
    Alta · 7.5 CVE-2022-3697 >= 2.5.0, < 7.0.0 7.0.0
  3. Improper Input Validation and Command Injection in Ansible
    Alta · 7.1 CVE-2021-3583 < 2.9.23rc1, >= 2.10.0a1, < 2.10.11rc1, >= 2.11.0a1, < 2.11.2rc1 2.9.23rc1, 2.10.11rc1, 2.11.2rc1
  4. Insertion of Sensitive Information into Log File in ansible
    Alta · 5.5 CVE-2021-20178 < 2.9.18 2.9.18
  5. Ansible Exposes Sensitive Information
    Alta · 7.5 CVE-2021-20228 >= 2.10.0a1, < 2.10.6rc1, >= 2.9.0a1, < 2.9.18rc1, < 2.8.19rc1 2.10.6rc1, 2.9.18rc1, 2.8.19rc1
  6. OS Command Injection and Improper Input Validation in ansible
    Alta · 7.3 CVE-2019-14904 < 2.7.16, >= 2.8.0a1, < 2.8.8, >= 2.9.0a1, < 2.9.3 2.7.16, 2.8.8, 2.9.3
  7. Externally Controlled Reference to a Resource in Another Sphere, Improper Input Validation, and External Control of File Name or Path in Ansible
    Alta · 5.6 CVE-2019-14905 >= 2.7.0a1, < 2.7.16, >= 2.8.0a1, < 2.8.8, >= 2.9.0a1, < 2.9.3 2.7.16, 2.8.8, 2.9.3
  8. Path Traversal in Ansible
    Alta · 7.8 CVE-2020-1737 >= 2.8.0a1, < 2.8.9, >= 2.9.0a1, < 2.9.6, < 2.7.17 2.8.9, 2.9.6, 2.7.17
  9. OS Command Injection in ansible
    Alta · 7.4 CVE-2020-1734 >= 2.10.0a1, < 2.10.0rc1, >= 2.9.0a1, < 2.9.11, < 2.8.13 2.10.0rc1, 2.9.11, 2.8.13
  10. The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.
    Crítica · 9.8 CVE-2014-4657 < 1.5.4 1.5.4
  11. The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability ex
    Crítica · 9.8 CVE-2014-4678 < 1.6.4 1.6.4
  12. Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as de
    Crítica · 9.8 CVE-2014-4967 < 1.6.7 1.6.7
  13. Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code v
    Crítica · 9.8 CVE-2014-4966 < 1.6.7 1.6.7
  14. Ansible prior to 1.5.4 mishandles the evaluation of some strings.
    Alta · 7.5 CVE-2014-2686 < 1.5.4 1.5.4
  15. ansible before versions 2.8.6, 2.7.14, 2.6.20 is vulnerable to a None
    Alta · 6.5 CVE-2019-14856 >= 2.6.0, < 2.6.20, >= 2.7.0, < 2.7.14, >= 2.8.0, < 2.8.6 2.6.20, 2.7.14, 2.8.6
  16. Exposure of Sensitive Information to an Unauthorized Actor in ansible
    Alta · 6.5 CVE-2019-10217 >= 2.8.0a1, < 2.8.4 2.8.4
  17. ansible-playbook -k and ansible cli tools, all versions 2.8.x before 2.8.4, all 2.7.x before 2.7.13 and all 2.6.x before 2.6.19, prompt passwords by expanding them from templates as they could contain
    Alta · 6.5 CVE-2019-10206 >= 2.6.0, < 2.6.19, >= 2.7.0, < 2.7.13, >= 2.8.0, < 2.8.4 2.6.19, 2.7.13, 2.8.4
  18. In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin
    Alta · 7.8 CVE-2019-14846 < 2.6.20, >= 2.7.0, < 2.7.14, >= 2.8.0, < 2.8.6 2.6.20, 2.7.14, 2.8.6
  19. ansible before versions 2.5.14, 2.6.11, 2.7.5 is vulnerable to a information disclosure flaw in vvv+ mode with no_log on that can lead to leakage of sensible data.
    Alta · 5.3 CVE-2018-16876 >= 2.5.0, < 2.5.14, >= 2.6.0, < 2.6.11, >= 2.7.0, < 2.7.5 2.5.14, 2.6.11, 2.7.5
  20. Ansible "User" module leaks any data which is passed on as a parameter to ssh-keygen. This could lean in undesirable situations such as passphrases credentials passed as a parameter for the ssh-keygen
    Alta · 7.8 CVE-2018-16837 >= 2.7, < 2.7.1, >= 2.6, < 2.6.7, < 2.5.11 2.7.1, 2.6.7, 2.5.11
  21. Ansible apt_key module does not properly verify key fingerprint
    Alta · 7.5 CVE-2016-8614 < 2.2.0.0 2.2.0.0
Mostrar más (12) Mostrando 21 de 33

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.