GHSA-99w6-3xph-cx78

Suggest an improvement
Source
https://github.com/advisories/GHSA-99w6-3xph-cx78
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-99w6-3xph-cx78/GHSA-99w6-3xph-cx78.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-99w6-3xph-cx78
Aliases
Related
Published
2024-11-12T00:30:36Z
Modified
2024-12-18T06:34:51.928054Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L CVSS Calculator
  • 1.2 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P CVSS Calculator
Summary
Ansible-Core vulnerable to content protections bypass
Details

A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.

Database specific 
{
    "nvd_published_at": "2024-11-12T00:15:15Z",
    "cwe_ids": [
        "CWE-20"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-12T21:35:36Z"
}
References

Affected packages

PyPI / ansible-core

Package

Name
ansible-core
View open source insights on deps.dev
Purl
pkg:pypi/ansible-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.18.0b1
Fixed
2.18.1rc1

Affected versions

2.*

2.18.0b1
2.18.0rc1
2.18.0rc2
2.18.0

PyPI / ansible-core

Package

Name
ansible-core
View open source insights on deps.dev
Purl
pkg:pypi/ansible-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.17.0b1
Fixed
2.17.7rc1

Affected versions

2.*

2.17.0b1
2.17.0rc1
2.17.0rc2
2.17.0
2.17.1rc1
2.17.1
2.17.2rc1
2.17.2rc2
2.17.2
2.17.3rc1
2.17.3
2.17.4rc1
2.17.4
2.17.5rc1
2.17.5
2.17.6rc1
2.17.6

PyPI / ansible-core

Package

Name
ansible-core
View open source insights on deps.dev
Purl
pkg:pypi/ansible-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.16.14rc1

Affected versions

0.*

0.0.1a1

2.*

2.11.0b1
2.11.0b2
2.11.0b3
2.11.0b4
2.11.0rc1
2.11.0rc2
2.11.0
2.11.1rc1
2.11.1
2.11.2rc1
2.11.2
2.11.3rc1
2.11.3
2.11.4rc1
2.11.4
2.11.5rc1
2.11.5
2.11.6rc1
2.11.6
2.11.7rc1
2.11.7
2.11.8rc1
2.11.8
2.11.9rc1
2.11.9
2.11.10rc1
2.11.10
2.11.11rc1
2.11.11
2.11.12rc1
2.11.12
2.12.0b1
2.12.0b2
2.12.0rc1
2.12.0
2.12.1rc1
2.12.1
2.12.2rc1
2.12.2
2.12.3rc1
2.12.3
2.12.4rc1
2.12.4
2.12.5rc1
2.12.5
2.12.6rc1
2.12.6
2.12.7rc1
2.12.7
2.12.8rc1
2.12.8
2.12.9rc1
2.12.9
2.12.10rc1
2.12.10
2.13.0b0
2.13.0b1
2.13.0rc1
2.13.0
2.13.1rc1
2.13.1
2.13.2rc1
2.13.2
2.13.3rc1
2.13.3
2.13.4rc1
2.13.4
2.13.5rc1
2.13.5
2.13.6rc1
2.13.6
2.13.7rc1
2.13.7
2.13.8rc1
2.13.8
2.13.9rc1
2.13.9
2.13.10rc1
2.13.10
2.13.11rc1
2.13.11
2.13.12rc1
2.13.12
2.13.13rc1
2.13.13
2.14.0b1
2.14.0b2
2.14.0b3
2.14.0rc1
2.14.0rc1.post0
2.14.0rc2
2.14.0
2.14.1rc1
2.14.1
2.14.2rc1
2.14.2
2.14.3rc1
2.14.3
2.14.4rc1
2.14.4
2.14.5rc1
2.14.5
2.14.6rc1
2.14.6
2.14.7rc1
2.14.7
2.14.8rc1
2.14.8
2.14.9rc1
2.14.9
2.14.10rc1
2.14.10
2.14.11rc1
2.14.11
2.14.12rc1
2.14.12
2.14.13
2.14.14rc1
2.14.14
2.14.15rc1
2.14.15
2.14.16rc1
2.14.16
2.14.17rc1
2.14.17
2.14.18rc1
2.14.18
2.15.0b1
2.15.0b2
2.15.0b3
2.15.0rc1
2.15.0rc2
2.15.0
2.15.1rc1
2.15.1
2.15.2rc1
2.15.2
2.15.3rc1
2.15.3
2.15.4rc1
2.15.4
2.15.5rc1
2.15.5
2.15.6rc1
2.15.6
2.15.7rc1
2.15.7
2.15.8
2.15.9rc1
2.15.9
2.15.10rc1
2.15.10
2.15.11rc1
2.15.11
2.15.12rc1
2.15.12
2.15.13rc1
2.15.13
2.16.0b1
2.16.0b2
2.16.0rc1
2.16.0
2.16.1rc1
2.16.1
2.16.2
2.16.3rc1
2.16.3
2.16.4rc1
2.16.4
2.16.5rc1
2.16.5
2.16.6
2.16.7rc1
2.16.7
2.16.8rc1
2.16.8
2.16.9rc1
2.16.9
2.16.10rc1
2.16.10
2.16.11rc1
2.16.11
2.16.12rc1
2.16.12
2.16.13rc1
2.16.13