Critical severityNVD Advisory· Published Feb 18, 2020· Updated Aug 6, 2024
CVE-2014-4966
CVE-2014-4966
Description
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to execute arbitrary code via (1) crafted lookup('pipe') calls or (2) crafted Jinja2 data.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ansiblePyPI | < 1.6.7 | 1.6.7 |
Affected products
8- Ansible/Ansibledescription
- ghsa-coords7 versionspkg:pypi/ansiblepkg:rpm/opensuse/ansible-10&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible-11&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible-12&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible-13&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible-9&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible&distro=openSUSE%20Tumbleweed
< 1.6.7+ 6 more
- (no CPE)range: < 1.6.7
- (no CPE)range: < 10.6.0-1.1
- (no CPE)range: < 11.11.0-1.1
- (no CPE)range: < 12.2.0-1.1
- (no CPE)range: < 13.7.0-1.1
- (no CPE)range: < 9.8.0-1.1
- (no CPE)range: < 2.2.0.0-1.1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-wqq5-c89p-3wc3ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2014-4966ghsaADVISORY
- www.ocert.org/advisories/ocert-2014-004.htmlghsax_refsource_MISCWEB
- github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527ghsax_refsource_CONFIRMWEB
- github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-204.yamlghsaWEB
News mentions
0No linked articles in our index yet.