CVE-2024-11079 Ansible-core: unsafe tagging bypass via hostvars object in ansible-core
Attackers can bypass unsafe content protections in Ansible-Core to execute arbitrary code via templated hostvars, requiring immediate patching.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-11079?
CVE-2024-11079 is a medium-severity code injection vulnerability in Red Hat Ansible Automation Platform Execution Environments, published on 11 Nov 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
Weakness: CWE-20
Which versions are affected by CVE-2024-11079?
7 open source packages ship an affected version, including ansible-core.
| Package | Affected | Fixed in |
|---|---|---|
ansible-core PyPI | All versions | 2.16.14rc1, 2.17.7rc1, 2.18.1rc1 |
ansible-core PyPI | All versions | 2.16.14rc1 |
ansible-core PyPI | All versions | 2.16.14rc1 |
ansible-core PyPI | From 2.17.0b1 | 2.17.7rc1 |
ansible-core PyPI | From 2.17.0b1 | 2.17.7rc1 |
ansible-core PyPI | From 2.18.0b1 | 2.18.1rc1 |
1 more packages
ansible-core PyPI | From 2.18.0b1 | 2.18.1rc1 |
Linux distribution packages (3)
ansible-core openSUSE:Tumbleweed | All versions | 2.18.1-1.1 |
ansible-core-2.16 openSUSE:Tumbleweed | All versions | 2.16.14-1.1 |
ansible-core-2.17 openSUSE:Tumbleweed | All versions | 2.17.7-1.1 |
How do I fix CVE-2024-11079?
Upgrade ansible-core to a fixed version for your release line: 2.16.14rc1, 2.17.7rc1 or 2.18.1rc1.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-11079 being exploited?
There is no known exploitation of CVE-2024-11079 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-11079, DLA-4502-1, GHSA-99w6-3xph-cx78, PYSEC-2026-1123, UBUNTU-CVE-2024-11079, openSUSE-SU-2024:14545-1 and 2 more.