CVE-2024-11079
Fixed in a distro release EPSS <1%CVSS 5.5
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
Products: Red Hat Ansible Automation Platform Execution Environments, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux AI (RHEL AI)
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | ansible-core | 2.18.1rc1 |
| PyPI | ansible-core | 2.17.7rc1 |
| PyPI | ansible-core | 2.16.14rc1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | ansible-operator | 1.37.0-r0 |
| Chainguard | ansible-operator-compat | 1.37.0-r0 |
| Chainguard | py3-ansible-core | 2.18.1-r0 |
| Chainguard | py3.11-ansible-core | 2.18.1-r0 |
| Chainguard | py3.12-ansible-core | 2.18.1-r0 |
| Chainguard | py3.13-ansible-core | 2.18.1-r0 |
| Debian 11 | ansible | 2.10.7+merged+base+2.10.17+dfsg-0+deb11u4 |
| Debian 12 | ansible | 5.4.0-1 |
| Debian 12 | ansible-core | 2.14.18-0+deb12u1 |
| Debian 13 | ansible | 5.4.0-1 |
| Debian 13 | ansible-core | 2.18.0-2 |
| Debian 14 | ansible | 5.4.0-1 |
| Debian 14 | ansible-core | 2.18.0-2 |
| Red Hat ansible automation platform 2.5 | ansible-core | 1:2.16.14-1.el9ap |
| Red Hat ansible automation platform 2.5 | ansible-core | 1:2.16.14-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20241218-1.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20241218-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | ansible-core | 1:2.16.14-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | ansible-core | 1:2.16.14-1.el8ap |
| Red Hat ansible automation platform inside 2.5 | ansible-core | 1:2.16.14-1.el8ap |
| Red Hat ansible automation platform inside 2.5 | ansible-core | 1:2.16.14-1.el9ap |
| Ubuntu 22.04 LTS | ansible-core | no fix |
| Ubuntu 24.04 LTS | ansible | no fix |
| Ubuntu 24.04 LTS | ansible-core | no fix |
| Ubuntu 25.10 | ansible | no fix |
| Ubuntu 25.10 | ansible-core | no fix |
| Ubuntu 26.04 LTS | ansible | no fix |
| Ubuntu 26.04 LTS | ansible-core | no fix |
| Ubuntu 26.10 | ansible | no fix |
| Ubuntu 26.10 | ansible-core | no fix |
| Ubuntu Pro 14.04 LTS | ansible | no fix |
| Ubuntu Pro 16.04 LTS | ansible | no fix |
| Ubuntu Pro 18.04 LTS | ansible | no fix |
| Ubuntu Pro 20.04 LTS | ansible | no fix |
| Ubuntu Pro 22.04 LTS | ansible | no fix |
| Wolfi | ansible-operator | 1.37.0-r0 |
| Wolfi | ansible-operator-compat | 1.37.0-r0 |
| Wolfi | py3-ansible-core | 2.18.1-r0 |
| Wolfi | py3.11-ansible-core | 2.18.1-r0 |
| Wolfi | py3.12-ansible-core | 2.18.1-r0 |
| Wolfi | py3.13-ansible-core | 2.18.1-r0 |
| openSUSE Tumbleweed | ansible-core | 2.18.1-1.1 |
| openSUSE Tumbleweed | ansible-core-2.16 | 2.16.14-1.1 |
| openSUSE Tumbleweed | ansible-core-2.17 | 2.17.7-1.1 |
| openSUSE Tumbleweed | ansible-core-2.18 | 2.18.10-2.1 |
| openSUSE Tumbleweed | ansible-core-2.19 | 2.19.4-1.1 |
| openSUSE Tumbleweed | ansible-core-2.20 | 2.20.6-1.1 |