Ansible CVE-2017-7481 Security Bypass Vulnerability

Bugtraq ID:	98492
Class:	Design Error
CVE:	CVE-2017-7481
Remote:	Yes
Local:	No
Published:	May 09 2017 12:00AM
Updated:	Aug 23 2017 09:11AM
Credit:	Jason McKerr of Red Hat.
Vulnerable:	Redhat Gluster Storage Server 3.2 on RHEL 7 Redhat Enterprise Virtualization Manager 4.1 AnsibleWorks ansible 0
Not Vulnerable:

Ansible CVE-2017-7481 Security Bypass Vulnerability

Ansible is prone to a security-bypass vulnerability.

An attacker may exploit this issue to bypass certain security restrictions and perform unauthorized actions.

Ansible CVE-2017-7481 Security Bypass Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Ansible CVE-2017-7481 Security Bypass Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Ansible CVE-2017-7481 Security Bypass Vulnerability

References:

• ansible Homepage (AnsibleWorks)
  
• ansible: Security issue with lookup return not tainting the jinja2 environment (Red Hat)
  
• Fixing security issue with lookup returns not tainting the jinja2 (Ansible)