PYSEC-2020-203

🗓️ 20 Feb 2020 03:15:00Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 4 Views

Ansible safe_eval before 1.6.4 allows remote code execution via crafted instructions due to an incomplete fix for vulnerability 2014 4657.

Reporter	Title	Published	Views	Family All 22
FreeBSD	ansible -- remote code execution vulnerability	25 Jun 201400:00	–	freebsd
CVE	CVE-2014-4678	20 Feb 202002:49	–	cve
Cvelist	CVE-2014-4678	20 Feb 202002:49	–	cvelist
Debian CVE	CVE-2014-4678	20 Feb 202002:49	–	debiancve
EUVD	EUVD-2020-0015	7 Oct 202500:30	–	euvd
Tenable Nessus	FreeBSD : ansible -- remote code execution vulnerability (2c493ac8-205e-11e5-a4a5-002590263bf5)	6 Jul 201500:00	–	nessus
Tenable Nessus	GLSA-201411-09 : Ansible: Privilege escalation	24 Nov 201400:00	–	nessus
Github Security Blog	Ansible Code Injection Vulnerability	24 May 202222:01	–	github
Gentoo Linux	Ansible: Privilege escalation	23 Nov 201400:00	–	gentoo
Mageia	Updated ansible package fixes multiple security issues	25 Aug 201408:44	–	mageia

Vulners

Node

ansible ansibleRange0–1.6.4

Source	Link
rapid7	www.rapid7.com/db/vulnerabilities/freebsd-vid-2c493ac8-205e-11e5-a4a5-002590263bf5
rapid7	www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2014-4678
openwall	www.openwall.com/lists/oss-security/2014/07/02/2
security-tracker	www.security-tracker.debian.org/tracker/CVE-2014-4678
openwall	www.openwall.com/lists/oss-security/2014/06/26/30
github	www.github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916
groups	www.groups.google.com/forum/message/raw
github	www.github.com/advisories/GHSA-66c7-5pwv-mm3j

02 Jul 2021 02:41Current

8High risk

Vulners AI Score8

CVSS 27.5

CVSS 3.19.8

EPSS0.05071