CVE-2014-4678
Fixed in a distro release EPSS 5%
The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.
Products: redhat ansible, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ansible | 1.6.4 |
| PyPI | ansible | 5429b85b9f6c2e640074176f36ff05fd5e4d1916 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ansible | 1.6.6+dfsg-1 |
| Debian 13 | ansible | 1.6.6+dfsg-1 |
| Debian 14 | ansible | 1.6.6+dfsg-1 |
| Ubuntu Pro 14.04 LTS | ansible | 1.5.4+dfsg-1ubuntu0.1~esm2 |