Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible
High severity
GitHub Reviewed
Published
Apr 7, 2021
to the GitHub Advisory Database
•
Updated Sep 6, 2024
Package
Affected versions
>= 2.7.0a1, < 2.7.17
>= 2.8.0a1, < 2.8.11
>= 2.9.0a1, < 2.9.7
Patched versions
2.7.17
2.8.11
2.9.7
Description
Published by the National Vulnerability Database
Mar 24, 2020
Reviewed
Apr 5, 2021
Published to the GitHub Advisory Database
Apr 7, 2021
Last updated
Sep 6, 2024
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.11, and 2.9.7 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
References