CVE-2017-2809 Code injection in ansible
Attackers can execute arbitrary Python commands by crafting a malicious Ansible Vault file, requiring an upgrade to the library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2017-2809?
CVE-2017-2809 is a high-severity code injection vulnerability in Tomohiro Nakamura ansible-vault, published on 14 Sep 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability.
Weakness: CWE-94
Which versions are affected by CVE-2017-2809?
3 open source packages ship an affected version, including ansible-vault. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ansible-vault PyPI | All versions | 1.0.5 |
ansible-vault PyPI | All versions | 1.0.5 |
ansible-vault PyPI | All versions | 1.0.5 |
Products include Ansible-Vault Project Ansible-Vault.
How do I fix CVE-2017-2809?
Upgrade ansible-vault to 1.0.5 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-2809 being exploited?
There is no known exploitation of CVE-2017-2809 in the wild and no public exploit code.
Sources
Also known as GHSA-c2w9-48qc-qpj4, PYSEC-2017-5.