{"action":"Upgrade ansible to 2.3.1.0 or later.","affected":[{"fixed":"2.3.1.0","introduced":"0"},{"fixed":"2.4.0.0","introduced":"2.3.2.0"}],"component":"ansible","cve_ids":["CVE-2017-7481"],"ecosystem":"PyPI","epss":0.04782,"exploited":false,"fixed_versions":["2.3.1.0","2.4.0.0"],"ghsa_id":"GHSA-w578-j992-554x","id":"tcs_01M5KG7ZKNWCK5268RH760FVXM","modified_at":"2023-11-08T03:59:24.627719Z","published_at":"2018-07-19T13:29:00Z","references":["https://osv.dev/vulnerability/PYSEC-2018-41","https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7481","https://access.redhat.com/errata/RHSA-2017:2524","https://access.redhat.com/errata/RHSA-2017:1599","https://access.redhat.com/errata/RHSA-2017:1499","https://access.redhat.com/errata/RHSA-2017:1476","https://access.redhat.com/errata/RHSA-2017:1334","https://access.redhat.com/errata/RHSA-2017:1244","http://www.securityfocus.com/bid/98492","https://usn.ubuntu.com/4072-1/","https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html","https://github.com/advisories/GHSA-w578-j992-554x"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"PYSEC-2018-41","url":"https://osv.dev/vulnerability/PYSEC-2018-41"}],"summary":"Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be"}