Description (CNA)
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Red Hat / Red Hat Ansible Automation Platform 2.4 for RHEL 8 | unaffected 1:2.15.8-1.el8ap before * |
| Red Hat / Red Hat Ansible Automation Platform 2.4 for RHEL 8 | unaffected 1:2.15.8-1.el8ap before * |
| Red Hat / Red Hat Ansible Automation Platform 2.4 for RHEL 9 | unaffected 1:2.15.8-1.el9ap before * |
| Red Hat / Red Hat Ansible Automation Platform 2.4 for RHEL 9 | unaffected 1:2.15.8-1.el9ap before * |
CWE
CWE-1336
References
- https://access.redhat.com/errata/RHSA-2023:7773
- https://access.redhat.com/security/cve/CVE-2023-5764
- https://bugzilla.redhat.com/show_bug.cgi?id=2247629
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.
- https://access.redhat.com/errata/RHSA-2023:7773
- https://access.redhat.com/security/cve/CVE-2023-5764
- https://bugzilla.redhat.com/show_bug.cgi?id=2247629
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7Q6CHPVCHMZS5M7V22GOKFSXZAQ24EU/
- https://security.netapp.com/advisory/ntap-20241025-0001/