CVE-2017-7481
CRITICAL
9.8
CVSS Severity Score
Vulnerability Description
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.
Affected Platforms (CPE)
📦
Redhat
Openshift Container Platform
= 3.3📦
Redhat
Openshift Container Platform
= 3.4📦
Redhat
Openshift Container Platform
= 3.5📦
Redhat
Openstack
= 10📦
Redhat
Openstack
= 11📦
Redhat
Storage Console
= 2.0📦
Redhat
Virtualization
= 4.1📦
Redhat
Virtualization Manager
= 4.1📦
Redhat
Gluster Storage
= 3.2📦
Redhat
Ansible Engine
< 2.3.1.0📦
Redhat
Ansible Engine
>= 2.3.2.0 and < 2.4.0.0💻
Canonical
Ubuntu Linux
= 16.04💻
Canonical
Ubuntu Linux
= 18.04💻
Canonical
Ubuntu Linux
= 19.04💻
Debian