A flaw was found in Ansible where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.

🗓️ 18 Oct 2021 07:00:00Reported by MicrosoftType

Ansible template injection via facts in YAML strings enables command execution and disclosure.

Reporter	Title	Published	Views	Family All 88
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues	30 Nov 202318:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to injection attacks in Ansible (CVE-2021-3583).	12 Jan 202321:59	–	ibm
IBM Security Bulletins	Security Bulletin: Ansible vulnerability affects IBM Elastic Storage System (CVE-2021-3583)	28 Feb 202211:18	–	ibm
FreeBSD	Ansible -- Templating engine bug	10 Jun 202100:00	–	freebsd
ATTACKERKB	CVE-2021-3583	22 Sep 202112:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : ansible (ALASANSIBLE2-2023-001)	27 Sep 202300:00	–	nessus
Tenable Nessus	FreeBSD : Ansible -- Templating engine bug (4c9159ea-d4c9-11eb-aeee-8c164582fbac)	25 Jun 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.9.23) (Important) (RHSA-2021:2663)	7 Jul 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.9.23) (Important) (RHSA-2021:2664)	7 Jul 202100:00	–	nessus
Tenable Nessus	SUSE SLES15: ansible / ansible-doc / ansible-test / dracut-saltboot / etc (SUSE-SU-2022:3178-1)	9 Sep 202200:00	–	nessus