{"id":"CVE-2017-7481","published":"2018-07-19T13:00:00Z","modified":"2024-08-05T16:04:11Z","title":"Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe","vendor":null,"product":"ansible","tier":"tail","description":{"text":"Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.","provenance":"source","from":"CVE.org"},"cvss":{"score":5.3,"severity":"MEDIUM","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.04782,"percentile":0.91904,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:1599","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7481","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1334","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/98492","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1244","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1499","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:2524","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1476","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://usn.ubuntu.com/4072-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":22.1,"factors":[{"name":"EPSS percentile","points":18.38},{"name":"CVSS severity","points":3.71}]},"affectedVersions":[{"vendor":"[UNKNOWN]","product":"ansible","versions":["ansible 2.3.1.0","ansible 2.4.0.0"]}],"affected":[{"ecosystem":"PyPI","package":"ansible","vulnerableRanges":[">=2.3.0.0, <2.3.1.0","<2.1.6.0",">=2.2.0.0, <2.2.3.0","<2.3.1.0",">=2.3.2.0, <2.4.0.0"],"patched":["2.3.1.0","2.1.6.0","2.2.3.0","2.4.0.0"],"from":["GHSA-w578-j992-554x","PYSEC-2018-41"],"provenance":"source"}],"euvd":{"id":"EUVD-2018-0014","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-ansible-cve-2018-10875","parents":[{"from":"CVE-2018-10875","to":"CVE-2017-7481","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/ansible/constants.py"],"commits":["https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2","https://github.com/ansible/ansible/commit/fd30f5328986f9e1da434474481f32bf918a600c","https://github.com/ansible/ansible/commit/ff980afefdbe4ceb828bdb1bb2eef03cf616bf63","https://github.com/ansible/ansible/commit/4cecbe81adbc655d7ab734165d3ac539f8ba5981"],"basis":"rarely changed file"}]}],"children":[{"from":"CVE-2017-7481","to":"CVE-2014-4678","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/ansible/constants.py"],"commits":["https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916","https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2","https://github.com/ansible/ansible/commit/fd30f5328986f9e1da434474481f32bf918a600c"],"basis":"rarely changed file"}]},{"from":"CVE-2017-7481","to":"CVE-2021-3583","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/ansible/template/__init__.py"],"commits":["https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2","https://github.com/ansible/ansible/commit/fd30f5328986f9e1da434474481f32bf918a600c","https://github.com/ansible/ansible/commit/03aff644cc1c00e1f7551195c68fbd0d13a39e6e","https://github.com/ansible/ansible/commit/8aa850e3573e48c9a2f12aef84e8a3a6f5ba4847"],"basis":"shared function","functions":["do_template"]}]}],"packageHistory":[{"cve":"CVE-2016-8614","published":"2018-07-31","fixed":"2.2.0.0","kev":false,"link":{"from":"CVE-2017-7481","to":"CVE-2016-8614","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.1.6.0","toFixed":"2.2.0.0","daysApart":12}]}},{"cve":"CVE-2016-8628","published":"2018-07-31","fixed":"2.2.0.0","kev":false,"link":{"from":"CVE-2017-7481","to":"CVE-2016-8628","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.1.6.0","toFixed":"2.2.0.0","daysApart":12}]}},{"cve":"CVE-2016-8647","published":"2018-07-26","fixed":"2.2.1.0","kev":false,"link":{"from":"CVE-2016-8647","to":"CVE-2017-7481","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.2.1.0","toFixed":"2.2.3.0","daysApart":-7}]}},{"cve":"CVE-2016-9587","published":"2018-04-24","fixed":"2.2.1.0","kev":false,"link":{"from":"CVE-2016-9587","to":"CVE-2017-7481","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.1.4.0","toFixed":"2.1.6.0","daysApart":86}]}},{"cve":"CVE-2017-7466","published":"2018-06-22","fixed":"2.3.0.0","kev":false,"link":{"from":"CVE-2017-7466","to":"CVE-2017-7481","relation":"successor","confidence":"high","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.3.0.0","toFixed":"2.3.1.0","daysApart":27},{"kind":"same-code","provenance":"machine","files":["lib/ansible/template/__init__.py"],"commits":["https://github.com/ansible/ansible/commit/0d418789a298561fded9bce977d34babc9097079","https://github.com/ansible/ansible/commit/7ff9fa52cfcef2065f0db80d85dd94b9b754839c","https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2","https://github.com/ansible/ansible/commit/fd30f5328986f9e1da434474481f32bf918a600c"],"basis":"shared file"}]}},{"cve":"CVE-2017-7481","published":"2018-07-19","fixed":"2.4.0.0","kev":false},{"cve":"CVE-2017-7550","published":"2017-11-21","fixed":"2.4.1.0","kev":false,"link":{"from":"CVE-2017-7550","to":"CVE-2017-7481","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:ansible","fromFixed":"2.3.3.0","toFixed":"2.4.0.0","daysApart":240}]}},{"cve":"CVE-2018-10855","published":"2018-07-02","fixed":"2.5.5","kev":false},{"cve":"CVE-2018-10874","published":"2018-07-02","fixed":"2.6.1","kev":false}],"package":"PyPI:ansible"}}