CVE-2014-4657

The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cve@mitre.org

Published

2020-02-20

Last modified

2024-08-06

Weaknesses

CWE-20

Affected products

• Ansible (Redhat)

References

• https://github.com/ansible/ansible/blob/release1.5.5/CHANGELOG.md
• https://www.securityfocus.com/bid/68232