{"id":"CVE-2014-4678","published":"2020-02-20T02:49:50Z","modified":"2024-08-06T11:27:35Z","title":"The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote…","vendor":null,"product":null,"tier":"tail","description":{"text":"The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.0524,"percentile":0.9251,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916","tags":["x_refsource_MISC"]},{"url":"https://groups.google.com/forum/message/raw?msg=ansible-announce/ieV1vZvcTXU/5Q93ThkY9rIJ","tags":["x_refsource_MISC"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-4678","tags":["x_refsource_MISC"]},{"url":"https://www.openwall.com/lists/oss-security/2014/06/26/30","tags":["x_refsource_MISC"]},{"url":"https://www.openwall.com/lists/oss-security/2014/07/02/2","tags":["x_refsource_MISC"]},{"url":"https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2014-4678","tags":["x_refsource_MISC"]},{"url":"https://www.rapid7.com/db/vulnerabilities/freebsd-vid-2c493ac8-205e-11e5-a4a5-002590263bf5","tags":["x_refsource_MISC"]}],"priority":{"score":18.5,"factors":[{"name":"EPSS percentile","points":18.5}]},"affectedVersions":[{"vendor":"n/a","product":"Ansible","versions":["before 1.6.4"]}],"affected":[{"ecosystem":"PyPI","package":"ansible","vulnerableRanges":["<1.6.4"],"patched":["1.6.4"],"from":["GHSA-66c7-5pwv-mm3j","PYSEC-2020-203"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0015","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ansible-cve-2018-10875","parents":[{"from":"CVE-2014-4657","to":"CVE-2014-4678","relation":"incomplete-fix","confidence":"high","kind":"lineage","orderedBy":"description","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.","from":"CVE.org","in":"CVE-2014-4678"},{"kind":"same-code","provenance":"machine","files":["lib/ansible/utils/__init__.py"],"commits":["https://github.com/ansible/ansible/commit/998793fd0ab55705d57527a38cee5e83f535974c","https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916"],"basis":"rarely changed file"},{"kind":"similar","provenance":"machine","score":0.92,"basis":"same package + description similarity"}]},{"from":"CVE-2018-10875","to":"CVE-2014-4678","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/ansible/constants.py"],"commits":["https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916","https://github.com/ansible/ansible/commit/ff980afefdbe4ceb828bdb1bb2eef03cf616bf63","https://github.com/ansible/ansible/commit/4cecbe81adbc655d7ab734165d3ac539f8ba5981"],"basis":"rarely changed file"}]},{"from":"CVE-2017-7481","to":"CVE-2014-4678","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/ansible/constants.py"],"commits":["https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916","https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2","https://github.com/ansible/ansible/commit/fd30f5328986f9e1da434474481f32bf918a600c"],"basis":"rarely changed file"}]},{"from":"CVE-2014-2686","to":"CVE-2014-4678","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/ansible/utils/__init__.py"],"commits":["https://github.com/ansible/ansible/commit/998793fd0ab55705d57527a38cee5e83f535974c","https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2014-4658","published":"2020-02-20","fixed":"1.5.5","kev":false,"link":{"from":"CVE-2014-4658","to":"CVE-2014-4678","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"1.5.5","toFixed":"1.6.4","daysApart":0}]}},{"cve":"CVE-2014-4659","published":"2020-02-20","fixed":"1.5.5","kev":false},{"cve":"CVE-2014-4660","published":"2020-02-20","fixed":"1.5.5","kev":false},{"cve":"CVE-2014-4678","published":"2020-02-20","fixed":"1.6.4","kev":false},{"cve":"CVE-2014-3498","published":"2017-06-08","fixed":"1.6.6","kev":false},{"cve":"CVE-2014-4966","published":"2020-02-18","fixed":"1.6.7","kev":false},{"cve":"CVE-2014-4967","published":"2020-02-18","fixed":"1.6.7","kev":false}],"package":"PyPI:ansible"}}