Python Ansible Vault Package CVE-2017-2809 Remote Code Execution Vulnerability

Bugtraq ID:	100824
Class:	Design Error
CVE:	CVE-2017-2809
Remote:	Yes
Local:	No
Published:	Sep 14 2017 12:00AM
Updated:	Sep 14 2017 12:00AM
Credit:	Cory Duplantis of Cisco Talos.
Vulnerable:	python Ansible Vault 1.0.4
Not Vulnerable:

Python Ansible Vault Package CVE-2017-2809 Remote Code Execution Vulnerability

Python Ansible Vault package is prone to a remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code within the context of user running the affected application. Failed exploit attempts may result in a denial-of-service condition.

Python Ansible Vault 1.0.4 is vulnerable; other versions may also be affected.

Python Ansible Vault Package CVE-2017-2809 Remote Code Execution Vulnerability

Researchers who discovered this issue have created a proof-of-concept. Please see the references for more information.

Python Ansible Vault Package CVE-2017-2809 Remote Code Execution Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Python Ansible Vault Package CVE-2017-2809 Remote Code Execution Vulnerability

References:

• ansible-vault Homepage (Python)
  
• Python Homepage (Python)
  
• TALOS-2017-0305 Ansible Vault Yaml Load Code Execution Vulnerability (talosintelligence.com)