CVE-2021-4041 ansible-runner vulnerable to shell command injection
Improper escaping in ansible-runner allows attackers to execute arbitrary shell commands on the host system via crafted parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-4041?
CVE-2021-4041 is a high-severity command injection vulnerability in ansible-runner, published on 24 Aug 2022. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.
Which versions are affected by CVE-2021-4041?
3 open source packages ship an affected version, including ansible-runner. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ansible-runner PyPI | All versions | 2.1.0 |
ansible-runner PyPI | All versions | 2.1.0 |
ansible-runner PyPI | All versions | 2.1.0 |
Linux distribution packages (2)
ansible-runner Red Hat:ansible_automation_platform:2.0::el8 | All versions | 0:2.0.3-2.el8ap |
python38-ansible-runner Red Hat:ansible_automation_platform:2.0::el8 | All versions | 0:2.0.3-2.el8ap |
Products include Redhat Ansible Runner.
How do I fix CVE-2021-4041?
Upgrade ansible-runner to 2.1.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2021-4041 being exploited?
There is no known exploitation of CVE-2021-4041 in the wild and no public exploit code.
Other vulnerabilities in ansible-runner
Sources
Also known as DEBIAN-CVE-2021-4041, GHSA-6j58-grhv-2769, PYSEC-2022-253, RHSA-2022:0108, UBUNTU-CVE-2021-4041.