CVE-2014-4657: Improper Input Validation

The safeeval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions...

CVE-2014-4678: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The safeeval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657...

Arbitrary Code Execution

ansible is vulnerable to arbitrary code execution. An attacker is able to execute arbitrary code on the system by passing malicious strings that will be evaluated and executed by the safeeval function...

Code injection

The safeeval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in 1 the collection.domain in the webdav module or 2 the formula...

CVE-2014-6633

The safeeval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in 1 the collection.domain in the webdav module or 2 the formula...

CVE-2014-6633

The safeeval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in 1 the collection.domain in the webdav module or 2 the formula...

DEBIAN-CVE-2014-6633

The safeeval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in 1 the collection.domain in the webdav module or 2 the formula...

PYSEC-2018-59

The safeeval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in 1 the collection.domain in the webdav module or 2 the formula...

CVE-2014-6633

The safeeval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in 1 the collection.domain in the webdav module or 2 the formula...

CVE-2014-6633

The safeeval function in trytond in Tryton before 2.4.15, 2.6.x before 2.6.14, 2.8.x before 2.8.11, 3.0.x before 3.0.7, and 3.2.x before 3.2.3 allows remote authenticated users to execute arbitrary commands via shell metacharacters in 1 the collection.domain in the webdav module or 2 the formula...

Debian DLA-70-1 : tryton-server security update

duesenfranz discovered, that safeeval in trytond could be used to execute arbitrary commands, mainly via the webdav interface. The patches applied do not allow double underscores in safeeval and avoid double evaluation from inherit with a different model. NOTE: Tenable Network Security has...

[SECURITY] [DLA 70-1] tryton-server security update

Package : tryton-server Version : 1.6.1-2+squeeze2 CVE ID : CVE-2014-6633 duesenfranz discovered, that safeeval in trytond could be used to execute arbitrary commands, mainly via the webdav interface. The patches applied do not allow double underscores in safeeval and avoid double evaluation from...

DLA-70-1 tryton-server - security update

Bulletin has no description...

Updated ansible package provides minor security fixes

Ansible has been patched with minor security fixes to safeeval and aptrepository that were fixed upstream in version 1.5.5...

MGASA-2014-0269 Updated ansible package provides minor security fixes

Ansible has been patched with minor security fixes to safeeval and aptrepository that were fixed upstream in version 1.5.5...

Fedora 19 : ansible-1.5.5-1.fc19 (2014-5375)

Update to 1.5.5. 2 minor security fixes in the apt and vault modules. https://github.com/ansible/ansible/blob/release1.5.4/CHANGELOG.md - Security fix for safeeval, which further hardens the checking of the evaluation function. - Fix for accelerate mode Note that Tenable Network Security has...

Fedora 20 : ansible-1.5.5-1.fc20 (2014-5407)

Update to 1.5.5. 2 minor security fixes in the apt and vault modules. https://github.com/ansible/ansible/blob/release1.5.4/CHANGELOG.md - Security fix for safeeval, which further hardens the checking of the evaluation function. - Fix for accelerate mode Note that Tenable Network Security has...