CVE-2014-4657: Input Validation
The safeeval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.
Other sources
The safeeval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4657?
The severity of CVE-2014-4657 is critical with a CVSS score of 9.8.
How can an attacker exploit CVE-2014-4657?
An attacker can exploit CVE-2014-4657 by sending crafted instructions to the vulnerable Ansible application, allowing them to execute arbitrary code remotely.
Which versions of Ansible are affected by CVE-2014-4657?
Ansible versions up to and including 1.5.4 are affected by CVE-2014-4657.
What is the recommended remedy for CVE-2014-4657?
The recommended remedy for CVE-2014-4657 is to update Ansible to version 1.5.4.
Where can I find more information about CVE-2014-4657?
You can find more information about CVE-2014-4657 at the following references: [Reference 1](https://nvd.nist.gov/vuln/detail/CVE-2014-4657), [Reference 2](https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md), [Reference 3](https://github.com/ansible/ansible/commit/998793fd0ab55705d57527a38cee5e83f535974c).