CVE-2014-4967

Advisory

ansible 1.6.7 contains two security fixes:
* Strip lookup calls out of inventory variables and clean unsafe data
returned from lookup plugins (CVE-2014-4966)
* Make sure vars don't insert extra parameters into module args and prevent
duplicate params from superseding previous params (CVE-2014-4967)

Affected package

Affected versions

Fixed versions

Vulnerability changelog

- Security fixes:
* Strip lookup calls out of inventory variables and clean unsafe data
returned from lookup plugins (CVE-2014-4966)
* Make sure vars don't insert extra parameters into module args and prevent
duplicate params from superseding previous params (CVE-2014-4967)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4967
• https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527
• http://www.ocert.org/advisories/ocert-2014-004.html