CVE-2017-7481

Description

Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.

How to fix CVE-2017-7481

To remediate CVE-2017-7481, upgrade the affected package to a fixed version below.

• —upgrade to 2.3.1.0+dfsg-1 or later
• —upgrade to 2.2.1.0-2+deb9u2 or later
• —upgrade to 2.3.1.0 or later
• —upgrade to ed56f51f185a1ffd7ea57130d260098686fcc7c2 or later

Is CVE-2017-7481 being exploited?

Low — EPSS is 4.3%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 2.3.1.0+dfsg-1
• from 0, < 2.2.1.0-2+deb9u2
• >= 2.3.0.0, < 2.3.1.0
• from 0, < ed56f51f185a1ffd7ea57130d260098686fcc7c2 | from 0, < 2.3.1.0, >= 2.3.2.0, < 2.4.0.0

CVSS scores

References (21)

• ADVISORYgithub.com/advisories/GHSA-w578-j992-554x
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2017-7481
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2017-7481
• PATCHgithub.com/ansible/ansible
• WEB