What is GHSA-wqq5-c89p-3wc3?

GHSA-wqq5-c89p-3wc3 is a security advisory published by GitHub Security Advisories with Critical severity. Ansible Arbitrary Code Execution

Which CVE IDs does GHSA-wqq5-c89p-3wc3 cover?

GHSA-wqq5-c89p-3wc3 covers the following CVE IDs: CVE-2014-4966. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wqq5-c89p-3wc3?

GHSA-wqq5-c89p-3wc3 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-wqq5-c89p-3wc3?

GHSA-wqq5-c89p-3wc3 affects 1 product, including: pip/ansible:\u003c 1.6.7.

GHSA-wqq5-c89p-3wc3CriticalCVSS 9.8

Ansible Arbitrary Code Execution

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

September 10, 2024

🔗 CVE IDs covered (1)

CVE-2014-4966 →

📋 Description

Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.

🎯 Affected products1

pip/ansible:< 1.6.7

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2014-4966
https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527
http://www.ocert.org/advisories/ocert-2014-004.html
https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-204.yaml
https://github.com/advisories/GHSA-wqq5-c89p-3wc3