{"id":"CVE-2014-4657","published":"2020-02-20T14:28:16Z","modified":"2024-08-06T11:20:26Z","title":"The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote…","vendor":null,"product":null,"tier":"tail","description":{"text":"The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04427,"percentile":0.91336,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md","tags":["x_refsource_CONFIRM"]},{"url":"https://www.securityfocus.com/bid/68232","tags":["vdb-entry","x_refsource_BID"]}],"priority":{"score":18.3,"factors":[{"name":"EPSS percentile","points":18.27}]},"affected":[{"ecosystem":"PyPI","package":"ansible","vulnerableRanges":["<1.5.4"],"patched":["1.5.4"],"from":["GHSA-qg47-5px9-32g7","PYSEC-2020-199"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0010","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ansible-cve-2018-10875","children":[{"from":"CVE-2014-4657","to":"CVE-2014-4678","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.","from":"CVE.org","in":"CVE-2014-4678"},{"kind":"same-code","provenance":"machine","files":["lib/ansible/utils/__init__.py"],"commits":["https://github.com/ansible/ansible/commit/998793fd0ab55705d57527a38cee5e83f535974c","https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.92,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2013-4259","published":"2013-09-16","fixed":"1.2.3","kev":false},{"cve":"CVE-2013-4260","published":"2013-09-16","fixed":"1.2.3","kev":false},{"cve":"CVE-2014-2686","published":"2020-01-09","fixed":"1.5.4","kev":false},{"cve":"CVE-2014-4657","published":"2020-02-20","fixed":"1.5.4","kev":false},{"cve":"CVE-2014-4658","published":"2020-02-20","fixed":"1.5.5","kev":false,"link":{"from":"CVE-2014-4657","to":"CVE-2014-4658","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"1.5.4","toFixed":"1.5.5","daysApart":0}]}},{"cve":"CVE-2014-4659","published":"2020-02-20","fixed":"1.5.5","kev":false,"link":{"from":"CVE-2014-4657","to":"CVE-2014-4659","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"1.5.4","toFixed":"1.5.5","daysApart":0}]}},{"cve":"CVE-2014-4660","published":"2020-02-20","fixed":"1.5.5","kev":false,"link":{"from":"CVE-2014-4657","to":"CVE-2014-4660","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"1.5.4","toFixed":"1.5.5","daysApart":0}]}}],"package":"PyPI:ansible"}}