CVE-2014-4967: Critical severity red hat ansible vulnerability
Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2014-4967?
CVE-2014-4967 is a vulnerability in Ansible before version 1.6.7 that allows remote attackers to execute arbitrary code by exploiting multiple argument injection vulnerabilities.
How severe is CVE-2014-4967?
CVE-2014-4967 has a severity rating of 9.8, which is considered critical.
What is the affected software for CVE-2014-4967?
The affected software for CVE-2014-4967 is Redhat Ansible versions up to and excluding 1.6.7.
How can I fix CVE-2014-4967?
To fix CVE-2014-4967, it is recommended to update Ansible to version 1.6.7 or newer.
Where can I find more information about CVE-2014-4967?
More information about CVE-2014-4967 can be found at the following links: http://www.ocert.org/advisories/ocert-2014-004.html, https://github.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527.