Remote Code Execution Vulnerability in Ansible by Red Hat

CVE-2017-7481

What is CVE-2017-7481?

Ansible versions before 2.3.1.0 and 2.4.0.0 are susceptible to a vulnerability due to improper marking of lookup-plugin results. An attacker controlling the results of lookup() calls could inject Unicode strings into the jinja2 templating system, leading to unauthorized code execution. The absence of safeguards allows evaluated templates to run dangerous code, posing a significant security risk to affected systems.

References