ansible: Template Injection through yaml multi-line strings with ansible facts used in template.

🗓️ 13 Jul 2021 17:01:37Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 2 Views

Ansible template injection via multi-line YAML strings using facts can permit command injection and expose data.

Reporter	Title	Published	Views	Family All 88
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues	30 Nov 202318:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to injection attacks in Ansible (CVE-2021-3583).	12 Jan 202321:59	–	ibm
IBM Security Bulletins	Security Bulletin: Ansible vulnerability affects IBM Elastic Storage System (CVE-2021-3583)	28 Feb 202211:18	–	ibm
FreeBSD	Ansible -- Templating engine bug	10 Jun 202100:00	–	freebsd
ATTACKERKB	CVE-2021-3583	22 Sep 202112:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : ansible (ALASANSIBLE2-2023-001)	27 Sep 202300:00	–	nessus
Tenable Nessus	FreeBSD : Ansible -- Templating engine bug (4c9159ea-d4c9-11eb-aeee-8c164582fbac)	25 Jun 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.9.23) (Important) (RHSA-2021:2663)	7 Jul 202100:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.9.23) (Important) (RHSA-2021:2664)	7 Jul 202100:00	–	nessus
Tenable Nessus	SUSE SLES15: ansible / ansible-doc / ansible-test / dracut-saltboot / etc (SUSE-SU-2022:3178-1)	9 Sep 202200:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	ansible	2.9.23-1.el8ap	ansible-2.9.23-1.el8ap.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2021-3583
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-3583
cve	www.cve.org/CVERecord

26 Jun 2026 18:29Current

6.8Medium risk

Vulners AI Score6.8

CVSS 23.6

CVSS 3.17.1

EPSS0.00889

ansible template injection yaml multi line facts usage command injection sensitive data confidentiality integrity security flaw