CVE-2014-4967
Fixed in a distro release EPSS 4%
Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command.
Products: redhat ansible
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ansible | 1.6.7 |
| PyPI | ansible | 62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ansible | 1.6.8+dfsg-1 |
| Debian 13 | ansible | 1.6.8+dfsg-1 |
| Debian 14 | ansible | 1.6.8+dfsg-1 |
| Ubuntu Pro 14.04 LTS | ansible | 1.5.4+dfsg-1ubuntu0.1~esm2 |
| openSUSE Tumbleweed | ansible | 2.2.0.0-1.1 |
| openSUSE Tumbleweed | ansible-10 | 10.6.0-1.1 |
| openSUSE Tumbleweed | ansible-11 | 11.11.0-1.1 |
| openSUSE Tumbleweed | ansible-12 | 12.2.0-1.1 |
| openSUSE Tumbleweed | ansible-13 | 13.7.0-1.1 |
| openSUSE Tumbleweed | ansible-9 | 9.8.0-1.1 |