CVE-2024-11079

Advisory

Affected versions of Ansible-Core before the fix are vulnerable to Improper Input Validation (CWE-20). This vulnerability allows attackers to bypass content protections by exploiting the hostvars object to execute templated content, potentially leading to arbitrary code execution within playbooks. The attack vector involves crafting malicious templates that reference and execute unsafe content through hostvars in hostvars.py. Vulnerable functions include the templating methods that do not properly manage serialization with native Jinja. To mitigate, upgrade to Ansible-Core version which implements proper handling and serialization of hostvars, preventing arbitrary code execution.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://github.com/advisories/GHSA-99w6-3xph-cx78
• https://github.com/ansible/ansible/pull/83509
• https://github.com/ansible/ansible/commit/6c0f4c8a2df78e0863723bffa06f6594b9bdd540#diff-b36fa2cf8e062dc662300f9e707a65fcdd9d6c3a51927a589643b67d3352e4f0R116
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11079