CVE-2017-7481
Fixed in a distro release EPSS 5%CVSS 5.3
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.
Products: redhat openshift_container_platform, redhat openstack, redhat storage_console, redhat virtualization, redhat virtualization_manager, redhat gluster_storage, redhat ansible_engine, canonical ubuntu_linux, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ansible | 2.3.1.0 |
| PyPI | ansible | 2.1.6.0 |
| PyPI | ansible | 2.2.3.0 |
| PyPI | ansible | ed56f51f185a1ffd7ea57130d260098686fcc7c2 |
| PyPI | ansible | 2.4.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ansible | 2.3.1.0+dfsg-1 |
| Debian 13 | ansible | 2.3.1.0+dfsg-1 |
| Debian 14 | ansible | 2.3.1.0+dfsg-1 |
| Debian 9 | ansible | 2.2.1.0-2+deb9u2 |
| Red Hat openshift 3.2 | ansible | 0:2.2.3.0-1.el7 |
| Red Hat openshift 3.2 | atomic-openshift-utils | 0:3.2.56-1.git.0.b844ab7.el7 |
| Red Hat openshift 3.2 | openshift-ansible | 0:3.2.56-1.git.0.b844ab7.el7 |
| Red Hat openshift 3.2 | openshift-ansible-docs | 0:3.2.56-1.git.0.b844ab7.el7 |
| Red Hat openshift 3.2 | openshift-ansible-filter-plugins | 0:3.2.56-1.git.0.b844ab7.el7 |
| Red Hat openshift 3.2 | openshift-ansible-lookup-plugins | 0:3.2.56-1.git.0.b844ab7.el7 |
| Red Hat openshift 3.2 | openshift-ansible-playbooks | 0:3.2.56-1.git.0.b844ab7.el7 |
| Red Hat openshift 3.2 | openshift-ansible-roles | 0:3.2.56-1.git.0.b844ab7.el7 |
| Red Hat openshift 3.3 | ansible | 0:2.2.3.0-1.el7 |
| Red Hat openshift 3.3 | atomic-openshift-utils | 0:3.3.82-1.git.0.af0c922.el7 |
| Red Hat openshift 3.3 | openshift-ansible | 0:3.3.82-1.git.0.af0c922.el7 |
| Red Hat openshift 3.3 | openshift-ansible-callback-plugins | 0:3.3.82-1.git.0.af0c922.el7 |
| Red Hat openshift 3.3 | openshift-ansible-docs | 0:3.3.82-1.git.0.af0c922.el7 |
| Red Hat openshift 3.3 | openshift-ansible-filter-plugins | 0:3.3.82-1.git.0.af0c922.el7 |
| Red Hat openshift 3.3 | openshift-ansible-lookup-plugins | 0:3.3.82-1.git.0.af0c922.el7 |
| Red Hat openshift 3.3 | openshift-ansible-playbooks | 0:3.3.82-1.git.0.af0c922.el7 |
| Red Hat openshift 3.3 | openshift-ansible-roles | 0:3.3.82-1.git.0.af0c922.el7 |
| Red Hat openshift 3.4 | ansible | 0:2.2.3.0-1.el7 |
| Red Hat openshift 3.4 | atomic-openshift-utils | 0:3.4.89-1.git.0.ac29ce8.el7 |
| Red Hat openshift 3.4 | openshift-ansible | 0:3.4.89-1.git.0.ac29ce8.el7 |
| Red Hat openshift 3.4 | openshift-ansible-callback-plugins | 0:3.4.89-1.git.0.ac29ce8.el7 |
| Red Hat openshift 3.4 | openshift-ansible-docs | 0:3.4.89-1.git.0.ac29ce8.el7 |
| Red Hat openshift 3.4 | openshift-ansible-filter-plugins | 0:3.4.89-1.git.0.ac29ce8.el7 |
| Red Hat openshift 3.4 | openshift-ansible-lookup-plugins | 0:3.4.89-1.git.0.ac29ce8.el7 |
| Red Hat openshift 3.4 | openshift-ansible-playbooks | 0:3.4.89-1.git.0.ac29ce8.el7 |
| Red Hat openshift 3.4 | openshift-ansible-roles | 0:3.4.89-1.git.0.ac29ce8.el7 |
| Red Hat openshift 3.5 | ansible | 0:2.2.3.0-1.el7 |
| Red Hat openshift 3.5 | atomic-openshift-utils | 0:3.5.71-1.git.0.128c2db.el7 |
| Red Hat openshift 3.5 | openshift-ansible | 0:3.5.71-1.git.0.128c2db.el7 |
| Red Hat openshift 3.5 | openshift-ansible-callback-plugins | 0:3.5.71-1.git.0.128c2db.el7 |
| Red Hat openshift 3.5 | openshift-ansible-docs | 0:3.5.71-1.git.0.128c2db.el7 |
| Red Hat openshift 3.5 | openshift-ansible-filter-plugins | 0:3.5.71-1.git.0.128c2db.el7 |
| Red Hat openshift 3.5 | openshift-ansible-lookup-plugins | 0:3.5.71-1.git.0.128c2db.el7 |
| Red Hat openshift 3.5 | openshift-ansible-playbooks | 0:3.5.71-1.git.0.128c2db.el7 |
| Red Hat openshift 3.5 | openshift-ansible-roles | 0:3.5.71-1.git.0.128c2db.el7 |
| Red Hat openstack 10 | ansible | 0:2.2.3.0-1.el7 |
| Red Hat openstack 11 | ansible | 0:2.2.3.0-1.el7 |
| Red Hat rhev manager 4 | ansible | 0:2.3.1.0-3.el7 |
| Red Hat rhev manager 4 | ansible-doc | 0:2.3.1.0-3.el7 |
| Red Hat rhscon 2 | ansible | 0:2.2.3.0-1.el7 |
| Red Hat storage 3.2 server el7 | ansible | 0:2.2.3.0-1.el7 |
| SUSE OpenStack Cloud 7 | ansible | 2.2.3.0-5.1 |
| SUSE OpenStack Cloud 7 | monasca-installer | 20170912_10.45-5.1 |
| SUSE Package Hub 12 | ansible | 2.4.1.0-6.1 |
| SUSE Package Hub 15 | ansible | 2.7.6-bp150.3.3.1 |
| Ubuntu 16.04 LTS | ansible | 2.0.0.2-2ubuntu1.3 |
| Ubuntu 18.04 LTS | ansible | 2.5.1+dfsg-1ubuntu0.1 |
| openSUSE Tumbleweed | ansible-10 | 10.6.0-1.1 |
| openSUSE Tumbleweed | ansible-11 | 11.11.0-1.1 |
| openSUSE Tumbleweed | ansible-12 | 12.2.0-1.1 |
| openSUSE Tumbleweed | ansible-13 | 13.7.0-1.1 |
| openSUSE Tumbleweed | ansible-9 | 9.8.0-1.1 |