A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
oryginał ENCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NRed Hat Ansible Automation Platform
APPRedhat1.2Red Hat Ansible Engine
APPRedhat< 2.9.23Red Hat Ansible Tower
APPRedhat< 3.7.0
Powiązane podatności
Ansible Tower before version 3.3.3 does not set a secure channel as it is using the default insecure configura...
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and...
_XcursorThemeInherits in library.c in libXcursor before 1.1.15 allows remote attackers to cause denial of serv...
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an atta...
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact vi...