SB2017091504 - Arbitrary code execution in Python Ansible Vault 



SB2017091504 - Arbitrary code execution in Python Ansible Vault

Published: September 15, 2017

Security Bulletin ID SB2017091504
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Adjecent network
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Command injection (CVE-ID: CVE-2017-2809)

The vulnerability allows an adjacent attacker to execute arbitrary commands on the target system.

The weakness exists in the yaml loading functionality due to improper processing of Yet Another Markup Language (YAML) content. An adjacent attacker can submit a specially crafted vault containing embedded Python code, and execute arbitrary commands.

Successful exploitation of the vulnerability results in code execution and system compromise.

Remediation

Install update from vendor's website.