CVE-2021-3583

Description

A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.

How to fix CVE-2021-3583

To remediate CVE-2021-3583, upgrade the affected package to a fixed version below.

• —upgrade to 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1 or later
• —upgrade to 2.12.0-1 or later
• —upgrade to 2.9.23rc1 or later
• —upgrade to 2.9.23 or later

Is CVE-2021-3583 being exploited?

Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.

Affected packages (4)

• from 0, < 2.10.7+merged+base+2.10.17+dfsg-0+deb11u1
• from 0, < 2.12.0-1
• from 0, < 2.9.23rc1
• from 0, < 2.9.23

CVSS scores

References (11)

• ADVISORYgithub.com/advisories/GHSA-2pfh-q76x-gwvm
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-3583
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-3583
• PATCHgithub.com/ansible/ansible
• WEB