The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows
    remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists
    because of an incomplete fix for CVE-2014-4657. (CVE-2014-4678)

Ansible, Inc. reports :

Incomplete Fix Remote Code Execution Vulnerability - Fixed in Ansible 1.6.4

The remote host is affected by the vulnerability described in GLSA-201411-09 (Ansible: Privilege escalation)

    Multiple vulnerabilities have been discovered in Ansible. Please review       the CVE identifiers referenced below for details.
  Impact :

    A local attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

ID	Name	Product	Family	Type	Severity
422356	SCA: security update for ansible (GHSA-66c7-5pwv-mm3j)	Tenable Cloud Security	SCA Checks	Local	critical
422356	SCA: security update for ansible (GHSA-66c7-5pwv-mm3j)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
401082	Alpine: multiple ansible packages: security update to 1.6.5-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	Local	critical
401082	Alpine: multiple ansible packages: security update to 1.6.5-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	Local	critical
84522	FreeBSD : ansible -- remote code execution vulnerability (2c493ac8-205e-11e5-a4a5-002590263bf5)	Nessus	FreeBSD Local Security Checks	Local	critical
79417	GLSA-201411-09 : Ansible: Privilege escalation	Nessus	Gentoo Local Security Checks	Local	critical

Detections

Analytics

CVE-2014-4678

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical