CVE-2017-2809

State: Published
Severity: 7.5 High
Published: Sep 14, 2017
Updated: Sep 16, 2024
Reserved: Dec 1, 2016

Description

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability.

Scores

CVSS	Score	Vector	Source
3.0	7.5 High	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	talos

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
ansible-vaultTomohiro Nakamura	1.0.4Affected

References

100824vdb-entry
https://github.com/tomoh1r/ansible-vault/blob/v1.0.5/CHANGES.txt
https://github.com/tomoh1r/ansible-vault/issues/4
https://github.com/tomoh1r/ansible-vault/commit/3f8f659ef443ab870bb19f95d43543470168ae04
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0305

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.