SB2017091504 - Arbitrary code execution in Python Ansible Vault
Published: September 15, 2017
Security Bulletin ID
SB2017091504
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Adjecent network
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Command injection (CVE-ID: CVE-2017-2809)
The vulnerability allows an adjacent attacker to execute arbitrary commands on the target system.The weakness exists in the yaml loading functionality due to improper processing of Yet Another Markup Language (YAML) content. An adjacent attacker can submit a specially crafted vault containing embedded Python code, and execute arbitrary commands.
Successful exploitation of the vulnerability results in code execution and system compromise.
Remediation
Install update from vendor's website.