PyPI/ansible CVE-2017-7481: unknown, EPSS 4.78%
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be
Action: Upgrade ansible to 2.3.1.0 or later.
pip install ansible==2.3.1.0pip install ansible==2.4.0.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.3.1.0 | - |
| 2.3.2.0 | 2.4.0.0 | - |
Fixed versions
| 2.3.1.0 | 2.4.0.0 |
Sources
- osv: PYSEC-2018-41
- https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7481
- https://access.redhat.com/errata/RHSA-2017:2524
- https://access.redhat.com/errata/RHSA-2017:1599
- https://access.redhat.com/errata/RHSA-2017:1499
- https://access.redhat.com/errata/RHSA-2017:1476
- https://access.redhat.com/errata/RHSA-2017:1334
- https://access.redhat.com/errata/RHSA-2017:1244
- http://www.securityfocus.com/bid/98492
- https://usn.ubuntu.com/4072-1/
- https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html
- https://github.com/advisories/GHSA-w578-j992-554x
CVE-2017-7481 · published · modified · JSON