PT-2020-7688 · Ansible+1 · Ansible+2

Jimi-C · Published 2014-07-26 · Updated 2025-11-21 · CVE-2014-4966

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ansible versions prior to 1.6.7

Description The issue allows remote attackers to execute arbitrary code via crafted lookup('pipe') calls or crafted Jinja2 data, due to the lack of prevention of inventory data with "{{" and "lookup" substrings, and remote data with "{{" substrings.

Recommendations For versions prior to 1.6.7, update to version 1.6.7 or later to resolve the issue. As a temporary workaround, consider restricting the use of lookup('pipe') calls and crafted Jinja2 data to minimize the risk of exploitation.

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

ALT-PU-2014-1957

CVE-2014-4966

GHSA-WQQ5-C89P-3WC3

MGASA-2014-0350

OPENSUSE-SU-2024:10326-1

OPENSUSE-SU-2024:14244-1

OPENSUSE-SU-2024:14536-1

OPENSUSE-SU-2025:15605-1

OPENSUSE-SU-2025:15753-1

PYSEC-2020-204

Affected Products

Alt Linux

Ansible

Ansible-Core

References · 72

• https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527 · Patch
• https://cve.org/CVERecord?id=CVE-2014-4966 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-4966 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-4966 · Vendor Advisory
• https://lists.fedoraproject.org/pipermail/package-announce/2014-August/136395.html · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-204 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-4966 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15753-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15605-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0350.html · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-4966 · Security Note
• https://osv.dev/vulnerability/GHSA-wqq5-c89p-3wc3 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:14244-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-4966 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10326-1 · Vendor Advisory