CVE-2014-4966
Fixed in a distro release EPSS 4%
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
Products: redhat ansible
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ansible | 1.6.7 |
| PyPI | ansible | 62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ansible | 1.6.8+dfsg-1 |
| Debian 13 | ansible | 1.6.8+dfsg-1 |
| Debian 14 | ansible | 1.6.8+dfsg-1 |
| Ubuntu Pro 14.04 LTS | ansible | 1.5.4+dfsg-1ubuntu0.1~esm2 |
| openSUSE Tumbleweed | ansible | 2.2.0.0-1.1 |
| openSUSE Tumbleweed | ansible-10 | 10.6.0-1.1 |
| openSUSE Tumbleweed | ansible-11 | 11.11.0-1.1 |
| openSUSE Tumbleweed | ansible-12 | 12.2.0-1.1 |
| openSUSE Tumbleweed | ansible-13 | 13.7.0-1.1 |
| openSUSE Tumbleweed | ansible-9 | 9.8.0-1.1 |