CVE-2021-4041

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansiblerunner.interface.runcommand, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.

References

Affected packages

Git / github.com/ansible/ansible-runner

Affected ranges

Type

GIT

Repo

https://github.com/ansible/ansible-runner

Events

Introduced

Fixed

41d0acb93abc6b2b54017aef2f53e0eeefbad00c

Fixed

3533f265f4349a3f2a0283158cd01b59a6bbc7bd

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.1.0"
        }
    ]
}

Affected versions

1.*

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.1.0

1.1.1

1.1.2

1.2.0

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

1.4.0

1.4.1

1.4.2

1.4.3

1.4.4

1.4.5

1.4.6

2.*

2.0.0-alpha1

2.0.0-alpha2

2.0.0-alpha3

2.1.0a1

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.1.0-alpha1"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.1.0-alpha2"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "2.1.0-beta1"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-4041.json"