CVE-2014-4678: Critical severity redhat ansible vulnerability
The safeeval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2014-4678?
CVE-2014-4678 is a vulnerability in the safe_eval function in Ansible before version 1.6.4 that allows remote attackers to execute arbitrary code through crafted instructions.
How severe is CVE-2014-4678?
CVE-2014-4678 has a severity rating of 9.8 (critical).
Which software versions are affected by CVE-2014-4678?
Ansible versions before 1.6.4 and some Debian versions (2.7.7+dfsg-1+deb10u1, 2.10.7+merged+base+2.10.8+dfsg-1, 7.3.0+dfsg-1, and 7.7.0+dfsg-1) are affected by CVE-2014-4678.
How can I fix CVE-2014-4678?
To fix CVE-2014-4678, upgrade to Ansible version 1.6.4 or later. For Debian users, install the specific fixed versions mentioned in the vulnerability description.
Where can I find more information about CVE-2014-4678?
You can find more information about CVE-2014-4678 at the following references: [NVD](https://nvd.nist.gov/vuln/detail/CVE-2014-4678), [GitHub Commit](https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916), [Google Groups](https://groups.google.com/forum/message/raw?msg=ansible-announce/ieV1vZvcTXU/5Q93ThkY9rIJ).