CVE-2021-3583: Input Validation
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
Other sources
if there are ansible users out there who are trying to put templates in multi-line yaml strings(https://yaml-multiline.info/), and the facts being handled don't routinely include special template characters, then their controller will be vulnerable to a template injection through the facts used in template.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.11.2rc1 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.10.11rc1 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.9.23rc1 - Upgrade
Upgrade
redhat/ansible_towerto a version that resolves this vulnerability.Fixed in 3.7 - Upgrade
Upgrade
redhat/ansible_engineto a version that resolves this vulnerability.Fixed in 2.9.23
Event History
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2021-3583.
What is the severity of CVE-2021-3583?
The severity of CVE-2021-3583 is high (7.1).
Which software products are affected by CVE-2021-3583?
The software products affected by CVE-2021-3583 are Redhat Ansible Automation Platform 1.2, Redhat Ansible Engine up to version 2.9.23, and Redhat Ansible Tower up to version 3.7.0.
How can this vulnerability be exploited?
This vulnerability can be exploited by injecting malicious templates into multi-line YAML strings when handling facts.
Is there a fix available for CVE-2021-3583?
Yes, there is a fix available for CVE-2021-3583. It is recommended to update to the latest version of the affected software.