VYPR
← All advisories
High severityNVD Advisory· Published Jun 22, 2018· Updated Aug 5, 2024

CVE-2017-7466

CVE-2017-7466

Description

Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Ansible before 2.3 has an input validation flaw in handling client facts, allowing authenticated attackers to execute arbitrary code on the server.

Vulnerability

Ansible versions before 2.3 contain an input validation vulnerability when processing facts sent from managed client systems [1][2]. The ansible server does not properly validate the data arriving from clients, allowing crafted fact payloads to be interpreted unsafely. This affects all Ansible deployments where clients can send fact data back to the controller node [1][2][4]. The flaw is addressed in Ansible 2.3.0.0 and later releases [1][4].

Exploitation

An attacker must have control over a client system that is managed by Ansible and be able to send facts back to the Ansible server [1][2]. No additional authentication bypass is required because the client is already authorized to return fact data. The attacker crafts a malicious fact payload that, when processed by the server, triggers code execution [2]. The exact sequence involves submitting the crafted facts during a normal facts-gathering operation [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the Ansible server with the privileges of the Ansible process (typically root or the ansible user) [1][2]. This compromises the confidentiality, integrity, and availability of the controller node and potentially all managed systems [2]. The attacker could deploy backdoors, steal credentials, or pivot to other infrastructure [2].

Mitigation

The vulnerability is fixed in Ansible 2.3.0.0, released alongside the upstream project [1][4]. Red Hat provided updates via RHSA-2017:1244 (for Red Hat Enterprise Linux) and RHSA-2017:1685 (for RHEV Engine 4.1) [1][4]. Users must upgrade to Ansible 2.3.0.0 or later. No workaround is documented; upgrading is the only complete mitigation [1][4]. The issue is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

References
  1. https://access.redhat.com/errata/RHSA-2017:1244
  2. NVD - CVE-2017-7466
  3. https://access.redhat.com/errata/RHSA-2017:1685

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ansiblePyPI
< 2.2.3.02.2.3.0

Affected products

146

Patches

2
7ff9fa52cfce

Revert "Fixing another corner case for security related to CVE-2016-9587"

https://github.com/ansible/ansibleJames CammarataApr 5, 2017via ghsa
commit
2 files changed · +4 −9
  • lib/ansible/template/__init__.py+2 −3 modified
    @@ -144,7 +144,7 @@ def _is_unsafe(self, val):
         '''
         if isinstance(val, dict):
             for key in val.keys():
-                if self._is_unsafe(key) or self._is_unsafe(val[key]):
+                if self._is_unsafe(val[key]):
                     return True
         elif isinstance(val, list):
             for item in val:
@@ -382,12 +382,11 @@ def template(self, variable, convert_bare=False, preserve_trailing_newlines=True
                             overrides=overrides,
                             disable_lookups=disable_lookups,
                         )
-
-                        unsafe = hasattr(result, '__UNSAFE__')
                         if convert_data and not self._no_type_regex.match(variable):
                             # if this looks like a dictionary or list, convert it to such using the safe_eval method
                             if (result.startswith("{") and not result.startswith(self.environment.variable_start_string)) or \
                                     result.startswith("[") or result in ("True", "False"):
+                                unsafe = hasattr(result, '__UNSAFE__')
                                 eval_results = safe_eval(result, locals=self._available_variables, include_exceptions=True)
                                 if eval_results[1] is None:
                                     result = eval_results[0]
  • lib/ansible/vars/unsafe_proxy.py+2 −6 modified
    @@ -98,14 +98,10 @@ def decode(self, obj):
 
 
 def _wrap_dict(v):
-    # Create new dict to get rid of the keys that are not wrapped.
-    new = {}
     for k in v.keys():
         if v[k] is not None:
-            new[wrap_var(k)] = wrap_var(v[k])
-        else:
-            new[wrap_var(k)] = None
-    return new
+            v[wrap_var(k)] = wrap_var(v[k])
+    return v
 
 
 def _wrap_list(v):
0d418789a298

Revert "Fixing another corner case for security related to CVE-2016-9587"

https://github.com/ansible/ansibleJames CammarataFeb 8, 2017via ghsa
commit
2 files changed · +4 −8
  • lib/ansible/template/__init__.py+2 −2 modified
    @@ -144,7 +144,7 @@ def _is_unsafe(self, val):
         '''
         if isinstance(val, dict):
             for key in val.keys():
-                if self._is_unsafe(key) or self._is_unsafe(val[key]):
+                if self._is_unsafe(val[key]):
                     return True
         elif isinstance(val, list):
             for item in val:
@@ -385,11 +385,11 @@ def template(self, variable, convert_bare=False, preserve_trailing_newlines=True
                             overrides=overrides,
                             disable_lookups=disable_lookups,
                         )
-                        unsafe = hasattr(result, '__UNSAFE__')
                         if convert_data and not self._no_type_regex.match(variable):
                             # if this looks like a dictionary or list, convert it to such using the safe_eval method
                             if (result.startswith("{") and not result.startswith(self.environment.variable_start_string)) or \
                                     result.startswith("[") or result in ("True", "False"):
+                                unsafe = hasattr(result, '__UNSAFE__')
                                 eval_results = safe_eval(result, locals=self._available_variables, include_exceptions=True)
                                 if eval_results[1] is None:
                                     result = eval_results[0]
  • lib/ansible/vars/unsafe_proxy.py+2 −6 modified
    @@ -98,14 +98,10 @@ def decode(self, obj):
 
 
 def _wrap_dict(v):
-    # Create new dict to get rid of the keys that are not wrapped.
-    new = {}
     for k in v.keys():
         if v[k] is not None:
-            new[wrap_var(k)] = wrap_var(v[k])
-        else:
-            new[wrap_var(k)] = None
-    return new
+            v[wrap_var(k)] = wrap_var(v[k])
+    return v
 
 
 def _wrap_list(v):

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

15

News mentions

0

No linked articles in our index yet.