ChainansiblePyPI:ansible
ansible: incomplete fixes (2018–2021)
6 CVEs over 3 generations, 13 Jul 2018 to 22 Sep 2021.
Family tree
Left to right by publication date.Oldest first. Select a CVE to open it.- CVE-2018-1087513 Jul 2018 First in the chain
- CVE-2017-748119 Jul 2018 related to CVE-2018-10875
- CVE-2014-26869 Jan 2020 No direct link to an earlier CVE
- CVE-2014-465720 Feb 2020 No direct link to an earlier CVE
- CVE-2014-467820 Feb 2020 incomplete fix for CVE-2014-4657related to CVE-2018-10875and 2 more
- CVE-2021-358322 Sep 2021 related to CVE-2017-7481
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low Link confidenceHow strong the evidence is that two CVEs are related. High: stated in the CVE text or linked in an advisory, or the same code was patched one release apart. Medium: the same code, or a version step plus a similar description. Low: similar description only.
CVEs in this family
Table view of the tree| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2018-10875 | 13 Jul 2018 | A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it… · fixed in 2.6.1 | First in chain | 15.1 |
| CVE-2017-7481 | 19 Jul 2018 | Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe · fixed in 2.4.0.0 | CVE-2018-10875 · related · Medium | 22.1 |
| CVE-2014-2686 | 9 Jan 2020 | Ansible prior to 1.5.4 mishandles the evaluation of some strings · fixed in 1.5.4 | First in chain | 13.6 |
| CVE-2014-4657 | 20 Feb 2020 | The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote… · fixed in 1.5.4 | First in chain | 18.3 |
| CVE-2014-4678 | 20 Feb 2020 | The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote… · fixed in 1.6.4 | CVE-2014-4657 · incomplete fix · High | 18.5 |
| CVE-2021-3583 | 22 Sep 2021 | A flaw was found in Ansible, where a user's controller is vulnerable to template injection · fixed in 2.11.2rc1 | CVE-2017-7481 · related · Medium | 11.9 |