Description (CNA)
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 0 through 2.18.0 |
| Red Hat / Ansible Automation Platform Execution Environments | unaffected 1.2.0-93 before * |
| Red Hat / Ansible Automation Platform Execution Environments | unaffected 3.0.1-108 before * |
| Red Hat / Ansible Automation Platform Execution Environments | unaffected 2.9.27-34 before * |
| Red Hat / Ansible Automation Platform Execution Environments | unaffected 2.12.10-56 before * |
| Red Hat / Ansible Automation Platform Execution Environments | unaffected 2.15.13-4 before * |
| Red Hat / Red Hat Ansible Automation Platform 2.5 for RHEL 8 | unaffected 1:2.16.14-1.el8ap before * |
| Red Hat / Red Hat Ansible Automation Platform 2.5 for RHEL 9 | unaffected 1:2.16.14-1.el9ap before * |
| Red Hat / Red Hat Enterprise Linux 10 | unaffected |
| Red Hat / Red Hat Enterprise Linux AI (RHEL AI) | affected |
| Red Hat / Red Hat Enterprise Linux AI (RHEL AI) | affected |
CWE
CWE-20
References
- https://access.redhat.com/errata/RHSA-2024:10770
- https://access.redhat.com/errata/RHSA-2024:11145
- https://access.redhat.com/security/cve/CVE-2024-11079
- https://bugzilla.redhat.com/show_bug.cgi?id=2325171
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.