CVE-2014-4967

Description

Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing a crafted fact, as demonstrated by a fact with (1) a trailing " src=" clause, (2) a trailing " temp=" clause, or (3) a trailing " validate=" clause accompanied by a shell command.

How to fix CVE-2014-4967

To remediate CVE-2014-4967, upgrade the affected package to a fixed version below.

• —upgrade to 1.6.8+dfsg-1 or later
• —upgrade to 1.6.7 or later
• —upgrade to 62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527 or later

Is CVE-2014-4967 being exploited?

Low — EPSS is 3.2%, meaning exploitation activity has not been observed at scale.

Affected packages (3)

• from 0, < 1.6.8+dfsg-1
• from 0, < 1.6.7
• from 0, < 62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527 | from 0, < 1.6.7

CVSS scores

References (6)

• ADVISORYgithub.com/advisories/GHSA-64cw-m57j-65xj
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-4967
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2014-4967
• WEBgithub.com/ansible/ansible/commit/62a1295a3e08cb6c3e9f1b2a1e6e5dcaeab32527