CVE-2017-7466: Input Validation
Ansible before version 2.3 has an input validation vulnerability in the handling of data sent from client systems. An attacker with control over a client system being managed by Ansible, and the ability to send facts back to the Ansible server, could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.
Other sources
It was found that code execution is still possible after applying bcceada5d9b78ad77069c78226f8e9b336ff8949 commit to fix CVE-2016-9587. This was fixed in ansible 2.3 by 0d418789a298561fded9bce977d34babc9097079 however it was not backported to previous versions.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7466?
CVE-2017-7466 has a critical severity rating due to the potential for arbitrary code execution.
How do I fix CVE-2017-7466?
To fix CVE-2017-7466, upgrade to Ansible version 2.3 or later.
What systems are affected by CVE-2017-7466?
CVE-2017-7466 affects Ansible versions before 2.3 and certain versions of Red Hat OpenStack.
Can an attacker exploit CVE-2017-7466 remotely?
An attacker must have control over a client system to exploit CVE-2017-7466, making remote exploitation less likely.
What kind of attack can be performed using CVE-2017-7466?
An attacker exploiting CVE-2017-7466 can execute arbitrary code on the Ansible server.