CVE-2014-4657

Advisory

Ansible 1.5.4 includes a fix for CVE-2014-4657: The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Security fix for safe_eval, which further hardens the checking of the evaluation function.
- Changing order of variable precedence for system facts, to ensure that inventory variables take precedence over any facts that may be set on a host.

Resources

• https://pypi.org/project/ansible
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4657
• https://www.securityfocus.com/bid/68232
• https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md