CVE-2017-2809 HIGH

CVE-2017-2809

Vendor Tomohiro Nakamura
Product ansible-vault
Published September 14, 2017
Last update September 16, 2024

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability.

Key dates

02Disclosure timeline

September 14, 2017 CVE published
September 16, 2024 Record updated