CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2017-7481
Critical (9.8). EPSS 4.8% chance of exploitation in the next 30 days. Fixed in ansible 2.1.6.0, 2.2.3.0, 2.3.1.0.
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.
Severity
- EPSS
- 4.8% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- canonical:ubuntu_linux
- debian:debian_linux
- redhat:ansible_engine
- redhat:gluster_storage
- redhat:openshift_container_platform
- redhat:openstack
- redhat:storage_console
- redhat:virtualization
- redhat:virtualization_manager
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-w578-j992-554x | PyPI | ansible | >=2.3.0.0 <2.3.1.0 | 2.3.1.0 |
| GHSA-w578-j992-554x | PyPI | ansible | <2.1.6.0 | 2.1.6.0 |
| GHSA-w578-j992-554x | PyPI | ansible | >=2.2.0.0 <2.2.3.0 | 2.2.3.0 |
| PYSEC-2018-41 | PyPI | ansible | <2.3.1.0 >=2.3.2.0 <2.4.0.0 | 2.3.1.0, 2.4.0.0 |