CVE-2021-3583: Input Validation
First published: Mon Jun 07 2021(Updated: )
A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.
Credit: secalert@redhat.com secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Ansible Automation Platform | =1.2 | |
| Redhat Ansible Engine | <2.9.23 | |
| Redhat Ansible Tower | <3.7.0 | |
| redhat/ansible_tower | <3.7 | 3.7 |
| redhat/ansible_engine | <2.9.23 | 2.9.23 |
| pip/ansible | >=2.11.0a1<2.11.2rc1 | 2.11.2rc1 |
| pip/ansible | >=2.10.0a1<2.10.11rc1 | 2.10.11rc1 |
| pip/ansible | >=0<2.9.23rc1 | 2.9.23rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1968412
- https://lists.debian.org/debian-lts-announce/2023/12/msg00018.html
- https://yaml-multiline.info/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1976097
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1976096
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1976098
- https://access.redhat.com/errata/RHSA-2021:2663
- https://access.redhat.com/errata/RHSA-2021:2664
- https://access.redhat.com/security/cve/cve-2021-3583
- https://nvd.nist.gov/vuln/detail/CVE-2021-3583
- https://github.com/ansible/ansible/pull/74960
- https://github.com/ansible/ansible/commit/03aff644cc1c00e1f7551195c68fbd0d13a39e6e
- https://github.com/ansible/ansible/commit/8aa850e3573e48c9a2f12aef84e8a3a6f5ba4847
- https://github.com/ansible/ansible/commit/8b17e5b9229ffaecfe10a4881bc3f87dd2c184e1
- https://github.com/advisories/GHSA-2pfh-q76x-gwvm (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2021-358.yaml
Frequently Asked Questions
What is the vulnerability ID of this flaw?
The vulnerability ID of this flaw is CVE-2021-3583.
What is the severity of CVE-2021-3583?
The severity of CVE-2021-3583 is high (7.1).
Which software products are affected by CVE-2021-3583?
The software products affected by CVE-2021-3583 are Redhat Ansible Automation Platform 1.2, Redhat Ansible Engine up to version 2.9.23, and Redhat Ansible Tower up to version 3.7.0.
How can this vulnerability be exploited?
This vulnerability can be exploited by injecting malicious templates into multi-line YAML strings when handling facts.
Is there a fix available for CVE-2021-3583?
Yes, there is a fix available for CVE-2021-3583. It is recommended to update to the latest version of the affected software.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2021-3583
- collector/nvd-cve
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-2pfh-q76x-gwvm
- agent/last-modified-date
- collector/github-advisory
- agent/references
- agent/softwarecombine
- agent/tags
- agent/trending
- vendor/redhat
- canonical/redhat ansible automation platform
- version/redhat ansible automation platform/1.2
- canonical/redhat ansible engine
- canonical/redhat ansible tower
- package-manager/redhat
- package-manager/pip