Lucene search
PRIOn knowledge basePRION:CVE-2014-4678HistoryFeb 20, 2020 - 3:15 a.m.
Code injection
2020-02-2003:15:00
PRIOn knowledge base
www.prio-n.com
3
The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.
| CPE | Name | Operator | Version |
|---|---|---|---|
| debian_linux | eq | 8.0 | |
| debian_linux | eq | 9.0 | |
| debian_linux | eq | 10.0 | |
| ansible | lt | 1.6.4 |
References
github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916
groups.google.com/forum/message/raw?msg=ansible-announce/ieV1vZvcTXU/5Q93ThkY9rIJ
security-tracker.debian.org/tracker/CVE-2014-4678
www.openwall.com/lists/oss-security/2014/06/26/30
www.openwall.com/lists/oss-security/2014/07/02/2
www.rapid7.com/db/vulnerabilities/freebsd-vid-2c493ac8-205e-11e5-a4a5-002590263bf5
www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2014-4678
Related
github
github
Ansible Code Injection Vulnerability
2022-05-24 22:01:18
Ansible Remote Code Execution
2022-05-17 19:57:32
cvelist
cvelist
CVE-2014-4678
2020-02-20 02:49:50
CVE-2014-4657
2020-02-20 14:28:16
osv
osv
Ansible Code Injection Vulnerability
2022-05-24 22:01:18
PYSEC-2020-203
2020-02-20 03:15:00
PYSEC-2020-199
2020-02-20 15:15:00
nvd
nvd
CVE-2014-4678
2020-02-20 03:15:10
CVE-2014-4657
2020-02-20 15:15:11
cve
cve
CVE-2014-4678
2020-02-20 03:15:10
CVE-2014-4657
2020-02-20 15:15:11
ubuntucve
ubuntucve
CVE-2014-4678
2020-02-20 00:00:00
CVE-2014-4657
2020-02-20 00:00:00
debiancve
debiancve
CVE-2014-4678
2020-02-20 03:15:10
CVE-2014-4657
2020-02-20 15:15:11
gentoo
gentoo
Ansible: Privilege escalation
2014-11-23 00:00:00
nessus
nessus
GLSA-201411-09 : Ansible: Privilege escalation
2014-11-24 00:00:00
openvas
openvas
Gentoo Security Advisory GLSA 201411-09
2015-09-29 00:00:00
Mageia: Security Advisory (MGASA-2014-0350)
2022-01-28 00:00:00
freebsd
freebsd
ansible -- remote code execution vulnerability
2014-06-25 00:00:00
redhatcve
redhatcve
CVE-2014-4678
2020-04-28 07:09:47
prion
prion
Code injection
2020-02-20 15:15:00
mageia
mageia
Updated ansible package fixes multiple security issues
2014-08-25 12:44:11