Critical severityNVD Advisory· Published Feb 18, 2020· Updated Aug 6, 2024
CVE-2014-4967
CVE-2014-4967
Description
Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ansiblePyPI | < 1.6.7 | 1.6.7 |
Affected products
8- Ansible/Ansibledescription
- ghsa-coords7 versionspkg:pypi/ansiblepkg:rpm/opensuse/ansible-10&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible-11&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible-12&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible-13&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible-9&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/ansible&distro=openSUSE%20Tumbleweed
< 1.6.7+ 6 more
- (no CPE)range: < 1.6.7
- (no CPE)range: < 10.6.0-1.1
- (no CPE)range: < 11.11.0-1.1
- (no CPE)range: < 12.2.0-1.1
- (no CPE)range: < 13.7.0-1.1
- (no CPE)range: < 9.8.0-1.1
- (no CPE)range: < 2.2.0.0-1.1
Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-64cw-m57j-65xjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2014-4967ghsaADVISORY
- www.ocert.org/advisories/ocert-2014-004.htmlghsax_refsource_MISCWEB
- github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527ghsax_refsource_CONFIRMWEB
- github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-205.yamlghsaWEB
News mentions
0No linked articles in our index yet.