netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-w578-j992-554x

Browse Source
This commit is contained in:
advisory-database[bot]
2025-05-29 22:48:54 +00:00
parent cfd5d6d719
commit 45de76a1f8
1 changed files with 85 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2018/09/GHSA-w578-j992-554x/GHSA-w578-j992-554x.json
+85 -43
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-w578-j992-554x",
"modified": "2024-09-04T18:45:21Z",
"modified": "2025-05-29T22:47:16Z",
"published": "2018-09-06T03:28:50Z",
"aliases": [
"CVE-2017-7481"
],
"summary": "Ansible fails to properly mark lookup-plugin results as unsafe",
"details": "Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.",
"details": "Ansible before versions 2.1.6.0, 2.2.3.0, 2.3.1.0, and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.",
"severity": [
{
"type": "CVSS_V3",
@@ -29,7 +29,7 @@
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
"introduced": "2.3.0.0"
},
{
"fixed": "2.3.1.0"
@@ -37,6 +37,44 @@
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.1.6.0"
}
]
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "2.2.0.0"
},
{
"fixed": "2.2.3.0"
}
]
}
]
}
],
"references": [
@@ -46,7 +84,11 @@
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/a1886911fcf4b691130cfc70dfc5daa5e07c46a3"
"url": "https://github.com/ansible/ansible/commit/fd30f5328986f9e1da434474481f32bf918a600c"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/f0e348f5eeb70c1fb3127d90891da43b5c0a9d29"
},
{
"type": "WEB",
@@ -54,47 +96,11 @@
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1244"
"url": "https://github.com/ansible/ansible/commit/a1886911fcf4b691130cfc70dfc5daa5e07c46a3"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1334"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1476"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1499"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1599"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2524"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7481"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-w578-j992-554x"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-41.yaml"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html"
"url": "https://web.archive.org/web/20170801122609/http://www.securityfocus.com/bid/98492"
},
{
"type": "WEB",
@@ -102,7 +108,43 @@
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20170801122609/http://www.securityfocus.com/bid/98492"
"url": "https://lists.debian.org/debian-lts-announce/2021/01/msg00023.html"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2018-41.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7481"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:2524"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1599"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1499"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1476"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1334"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2017:1244"
}
],
"database_specific": {