PT-2020-7685 · Ansible+1 · Ansible+2

Florian Weimer · Published 2014-07-26 · Updated 2022-05-24 · CVE-2014-4678

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ansible versions prior to 1.6.4

Description The issue is related to the safe eval function, which does not properly restrict the code subset. This allows remote attackers to execute arbitrary code via crafted instructions.

Recommendations For versions prior to 1.6.4, update to version 1.6.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the safe eval function until a patch is available.

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

ALT-PU-2014-1957

CVE-2014-4678

GHSA-66C7-5PWV-MM3J

MGASA-2014-0350

PYSEC-2020-203

Affected Products

Alt Linux

Ansible

Ansible-Core

References · 24

• https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916 · Patch
• https://openwall.com/lists/oss-security/2014/07/02/2 · Patch
• https://advisories.mageia.org/MGASA-2014-0350.html · Security Note
• https://ubuntu.com/security/CVE-2014-4678 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0350 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-4678 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-4678 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4678 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-4678 · Vendor Advisory
• https://openwall.com/lists/oss-security/2014/06/26/30 · Patch
• https://osv.dev/vulnerability/PYSEC-2020-203 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66c7-5pwv-mm3j · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-July/135284.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-4678 · Security Note
• https://lists.fedoraproject.org/pipermail/package-announce/2014-August/136395.html · Vendor Advisory