Vulnerability-Lookup

CVE-2024-11079 (GCVE-0-2024-11079)

Vulnerability from cvelistv5 – Published: 2024-11-11 23:32 – Updated: 2026-06-29 23:43

Title

Ansible-core: unsafe tagging bypass via hostvars object in ansible-core

Summary

A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.

Severity

5.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-12 14:41 UTC

CWE

CWE-20 - Improper Input Validation

Assigner

redhat redhat root

References

5 references

URL	Tags
https://access.redhat.com/errata/RHSA-2024:10770	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:11145	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-11079	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2325171	issue-trackingx_refsource_REDHAT
https://lists.debian.org/debian-lts-announce/2026…

Impacted products

10 products

Vendor	Product	Version
		Affected: 0 , ≤ 2.18.0 (semver)
Red Hat	Ansible Automation Platform Execution Environments	Unaffected: 1.2.0-93 , < * (rpm) cpe:/a:redhat:ansible_core:2::el8 cpe:/a:redhat:ansible_core:2::el9
Red Hat	Ansible Automation Platform Execution Environments	Unaffected: 3.0.1-108 , < * (rpm) cpe:/a:redhat:ansible_core:2::el8 cpe:/a:redhat:ansible_core:2::el9
Red Hat	Ansible Automation Platform Execution Environments	Unaffected: 2.9.27-34 , < * (rpm) cpe:/a:redhat:ansible_core:2::el8 cpe:/a:redhat:ansible_core:2::el9
Red Hat	Ansible Automation Platform Execution Environments	Unaffected: 2.12.10-56 , < * (rpm) cpe:/a:redhat:ansible_core:2::el8 cpe:/a:redhat:ansible_core:2::el9
Red Hat	Ansible Automation Platform Execution Environments	Unaffected: 2.15.13-4 , < * (rpm) cpe:/a:redhat:ansible_core:2::el8 cpe:/a:redhat:ansible_core:2::el9
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 8	Unaffected: 1:2.16.14-1.el8ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el8 cpe:/a:redhat:ansible_automation_platform:2.5::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9
Red Hat	Red Hat Ansible Automation Platform 2.5 for RHEL 9	Unaffected: 1:2.16.14-1.el9ap , < * (rpm) cpe:/a:redhat:ansible_automation_platform:2.5::el8 cpe:/a:redhat:ansible_automation_platform:2.5::el9 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9
Red Hat	Red Hat Enterprise Linux 10	cpe:/o:redhat:enterprise_linux:10
Red Hat	Red Hat Enterprise Linux AI (RHEL AI)	cpe:/a:redhat:enterprise_linux_ai:1

Date Public

2024-11-11 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-11079",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-12T14:41:52.352926Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-12T14:42:14.546Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2026-03-18T01:33:55.730Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2026/03/msg00006.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/ansible/ansible",
          "defaultStatus": "unaffected",
          "packageName": "ansible-core",
          "versions": [
            {
              "lessThanOrEqual": "2.18.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ansible_core:2::el8",
            "cpe:/a:redhat:ansible_core:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform/ansible-builder-rhel8",
          "product": "Ansible Automation Platform Execution Environments",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1.2.0-93",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ansible_core:2::el8",
            "cpe:/a:redhat:ansible_core:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform/ansible-builder-rhel9",
          "product": "Ansible Automation Platform Execution Environments",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3.0.1-108",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ansible_core:2::el8",
            "cpe:/a:redhat:ansible_core:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform/ee-29-rhel8",
          "product": "Ansible Automation Platform Execution Environments",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.9.27-34",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ansible_core:2::el8",
            "cpe:/a:redhat:ansible_core:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform/ee-minimal-rhel8",
          "product": "Ansible Automation Platform Execution Environments",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.12.10-56",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "cpes": [
            "cpe:/a:redhat:ansible_core:2::el8",
            "cpe:/a:redhat:ansible_core:2::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-automation-platform/ee-minimal-rhel9",
          "product": "Ansible Automation Platform Execution Environments",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2.15.13-4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-core",
          "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:2.16.14-1.el8ap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
            "cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "ansible-core",
          "product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:2.16.14-1.el9ap",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "unaffected",
          "packageName": "ansible-core",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux_ai:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhelai1/bootc-azure-nvidia-rhel9",
          "product": "Red Hat Enterprise Linux AI (RHEL AI)",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux_ai:1"
          ],
          "defaultStatus": "affected",
          "packageName": "rhelai1/bootc-nvidia-rhel9",
          "product": "Red Hat Enterprise Linux AI (RHEL AI)",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2024-11-11T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-29T23:43:22.569Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:10770",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:10770"
        },
        {
          "name": "RHSA-2024:11145",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:11145"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-11079"
        },
        {
          "name": "RHBZ#2325171",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325171"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-11-11T11:43:42.603Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-11-11T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Ansible-core: unsafe tagging bypass via hostvars object in ansible-core",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this vulnerability, avoid using the hostvars object to reference content marked as !unsafe. Ensure that all remote data from modules or lookups is properly sanitized and validated before use in playbooks. Additionally, restrict access to inventory files and Ansible playbooks to trusted users to minimize exploitation risks."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-20: Improper Input Validation"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-11079",
    "datePublished": "2024-11-11T23:32:55.539Z",
    "dateReserved": "2024-11-11T11:57:21.806Z",
    "dateUpdated": "2026-06-29T23:43:22.569Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-11079",
      "date": "2026-09-14",
      "epss": "0.00499",
      "percentile": "0.41248"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.\"}, {\"lang\": \"es\", \"value\": \"Se encontr\\u00f3 una falla en Ansible-Core. Esta vulnerabilidad permite a los atacantes eludir las protecciones de contenido inseguro mediante el objeto hostvars para hacer referencia y ejecutar contenido con plantilla. Este problema puede provocar la ejecuci\\u00f3n de c\\u00f3digo arbitrario si los datos remotos o las salidas de m\\u00f3dulos tienen plantillas incorrectas dentro de los playbooks.\"}]",
      "id": "CVE-2024-11079",
      "lastModified": "2024-12-18T04:15:06.310",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"secalert@redhat.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"LOW\"}, \"exploitabilityScore\": 1.3, \"impactScore\": 3.7}]}",
      "published": "2024-11-12T00:15:15.543",
      "references": "[{\"url\": \"https://access.redhat.com/errata/RHSA-2024:10770\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:11145\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2024-11079\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2325171\", \"source\": \"secalert@redhat.com\"}]",
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"secalert@redhat.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-20\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-11079\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2024-11-12T00:15:15.543\",\"lastModified\":\"2026-06-30T00:16:47.707\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 una falla en Ansible-Core. Esta vulnerabilidad permite a los atacantes eludir las protecciones de contenido inseguro mediante el objeto hostvars para hacer referencia y ejecutar contenido con plantilla. Este problema puede provocar la ejecuci\u00f3n de c\u00f3digo arbitrario si los datos remotos o las salidas de m\u00f3dulos tienen plantillas incorrectas dentro de los playbooks.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://github.com/ansible/ansible\",\"packageName\":\"ansible-core\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"2.18.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Ansible Automation Platform Execution Environments\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform/ansible-builder-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2::el8\",\"cpe:/a:redhat:ansible_core:2::el9\"],\"versions\":[{\"version\":\"1.2.0-93\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Ansible Automation Platform Execution Environments\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform/ansible-builder-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2::el8\",\"cpe:/a:redhat:ansible_core:2::el9\"],\"versions\":[{\"version\":\"3.0.1-108\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Ansible Automation Platform Execution Environments\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform/ee-29-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2::el8\",\"cpe:/a:redhat:ansible_core:2::el9\"],\"versions\":[{\"version\":\"2.9.27-34\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Ansible Automation Platform Execution Environments\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform/ee-minimal-rhel8\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2::el8\",\"cpe:/a:redhat:ansible_core:2::el9\"],\"versions\":[{\"version\":\"2.12.10-56\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Ansible Automation Platform Execution Environments\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform/ee-minimal-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_core:2::el8\",\"cpe:/a:redhat:ansible_core:2::el9\"],\"versions\":[{\"version\":\"2.15.13-4\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-core\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\",\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\",\"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8\",\"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9\",\"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8\",\"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9\"],\"versions\":[{\"version\":\"1:2.16.14-1.el8ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.5 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-core\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\",\"cpe:/a:redhat:ansible_automation_platform:2.5::el9\",\"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8\",\"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9\",\"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8\",\"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9\"],\"versions\":[{\"version\":\"1:2.16.14-1.el9ap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-core\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai1/bootc-azure-nvidia-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhelai1/bootc-nvidia-rhel9\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:1\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.3,\"impactScore\":3.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-11-12T14:41:52.352926Z\",\"id\":\"CVE-2024-11079\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/errata/RHSA-2024:10770\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2024:11145\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2024-11079\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2325171\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2026/03/msg00006.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T03:04:00+00:00",
      "cve": "CVE-2024-11079",
      "id": "CVE-2024-11079",
      "initial_release_date": "2024-11-11T00:00:00+00:00",
      "product_status:fixed": "57",
      "product_status:known_affected": "2",
      "product_status:known_not_affected": "68",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "ansible-core: Unsafe Tagging Bypass via hostvars Object in Ansible-Core",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-11079.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-27T00:42:43Z",
      "cve": "CVE-2024-11079",
      "id": "CVE-2024-11079",
      "initial_release_date": "2024-11-13T04:06:27Z",
      "product_status:known_not_affected": "8",
      "product_status:recommended": "15",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2024-11079",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-11079.json",
      "version": "23"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2026/03/msg00006.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-03-18T01:33:55.730Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-11079\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-11-12T14:41:52.352926Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-11-12T14:42:08.396Z\"}}], \"cna\": {\"title\": \"Ansible-core: unsafe tagging bypass via hostvars object in ansible-core\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 5.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}}], \"affected\": [{\"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"2.18.0\"}], \"packageName\": \"ansible-core\", \"collectionURL\": \"https://github.com/ansible/ansible\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2::el8\", \"cpe:/a:redhat:ansible_core:2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Ansible Automation Platform Execution Environments\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1.2.0-93\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform/ansible-builder-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2::el8\", \"cpe:/a:redhat:ansible_core:2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Ansible Automation Platform Execution Environments\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"3.0.1-108\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform/ansible-builder-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2::el8\", \"cpe:/a:redhat:ansible_core:2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Ansible Automation Platform Execution Environments\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2.9.27-34\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform/ee-29-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2::el8\", \"cpe:/a:redhat:ansible_core:2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Ansible Automation Platform Execution Environments\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2.12.10-56\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform/ee-minimal-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_core:2::el8\", \"cpe:/a:redhat:ansible_core:2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Ansible Automation Platform Execution Environments\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2.15.13-4\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform/ee-minimal-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\", \"cpe:/a:redhat:ansible_automation_platform:2.5::el9\", \"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8\", \"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9\", \"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8\", \"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:2.16.14-1.el8ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.5::el8\", \"cpe:/a:redhat:ansible_automation_platform:2.5::el9\", \"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8\", \"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9\", \"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8\", \"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.5 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1:2.16.14-1.el9ap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"ansible-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI)\", \"packageName\": \"rhelai1/bootc-azure-nvidia-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI)\", \"packageName\": \"rhelai1/bootc-nvidia-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2024-11-11T11:43:42.603Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2024-11-11T00:00:00.000Z\", \"value\": \"Made public.\"}], \"datePublic\": \"2024-11-11T00:00:00.000Z\", \"references\": [{\"url\": \"https://access.redhat.com/errata/RHSA-2024:10770\", \"name\": \"RHSA-2024:10770\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2024:11145\", \"name\": \"RHSA-2024:11145\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/security/cve/CVE-2024-11079\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2325171\", \"name\": \"RHBZ#2325171\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this vulnerability, avoid using the hostvars object to reference content marked as !unsafe. Ensure that all remote data from modules or lookups is properly sanitized and validated before use in playbooks. Additionally, restrict access to inventory files and Ansible playbooks to trusted users to minimize exploitation risks.\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-20\", \"description\": \"Improper Input Validation\"}]}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-06-29T23:43:22.569Z\"}, \"x_redhatCweChain\": \"CWE-20: Improper Input Validation\"}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-11079\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-29T23:43:22.569Z\", \"dateReserved\": \"2024-11-11T11:57:21.806Z\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"datePublished\": \"2024-11-11T23:32:55.539Z\", \"assignerShortName\": \"redhat\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

PYSEC-2026-1123

Vulnerability from pysec - Published: 2026-07-07 14:34 - Updated: 2026-07-07 17:23

Details

Severity

5.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

1.2 (Low)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P

Impacted products

Name	purl
ansible-core	pkg:pypi/ansible-core

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "ansible-core",
        "purl": "pkg:pypi/ansible-core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.16.14rc1"
            },
            {
              "introduced": "2.17.0b1"
            },
            {
              "fixed": "2.17.7rc1"
            },
            {
              "introduced": "2.18.0b1"
            },
            {
              "fixed": "2.18.1rc1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.1a1",
        "2.11.0",
        "2.11.0b1",
        "2.11.0b2",
        "2.11.0b3",
        "2.11.0b4",
        "2.11.0rc1",
        "2.11.0rc2",
        "2.11.1",
        "2.11.10",
        "2.11.10rc1",
        "2.11.11",
        "2.11.11rc1",
        "2.11.12",
        "2.11.12rc1",
        "2.11.1rc1",
        "2.11.2",
        "2.11.2rc1",
        "2.11.3",
        "2.11.3rc1",
        "2.11.4",
        "2.11.4rc1",
        "2.11.5",
        "2.11.5rc1",
        "2.11.6",
        "2.11.6rc1",
        "2.11.7",
        "2.11.7rc1",
        "2.11.8",
        "2.11.8rc1",
        "2.11.9",
        "2.11.9rc1",
        "2.12.0",
        "2.12.0b1",
        "2.12.0b2",
        "2.12.0rc1",
        "2.12.1",
        "2.12.10",
        "2.12.10rc1",
        "2.12.1rc1",
        "2.12.2",
        "2.12.2rc1",
        "2.12.3",
        "2.12.3rc1",
        "2.12.4",
        "2.12.4rc1",
        "2.12.5",
        "2.12.5rc1",
        "2.12.6",
        "2.12.6rc1",
        "2.12.7",
        "2.12.7rc1",
        "2.12.8",
        "2.12.8rc1",
        "2.12.9",
        "2.12.9rc1",
        "2.13.0",
        "2.13.0b0",
        "2.13.0b1",
        "2.13.0rc1",
        "2.13.1",
        "2.13.10",
        "2.13.10rc1",
        "2.13.11",
        "2.13.11rc1",
        "2.13.12",
        "2.13.12rc1",
        "2.13.13",
        "2.13.13rc1",
        "2.13.1rc1",
        "2.13.2",
        "2.13.2rc1",
        "2.13.3",
        "2.13.3rc1",
        "2.13.4",
        "2.13.4rc1",
        "2.13.5",
        "2.13.5rc1",
        "2.13.6",
        "2.13.6rc1",
        "2.13.7",
        "2.13.7rc1",
        "2.13.8",
        "2.13.8rc1",
        "2.13.9",
        "2.13.9rc1",
        "2.14.0",
        "2.14.0b1",
        "2.14.0b2",
        "2.14.0b3",
        "2.14.0rc1",
        "2.14.0rc1.post0",
        "2.14.0rc2",
        "2.14.1",
        "2.14.10",
        "2.14.10rc1",
        "2.14.11",
        "2.14.11rc1",
        "2.14.12",
        "2.14.12rc1",
        "2.14.13",
        "2.14.14",
        "2.14.14rc1",
        "2.14.15",
        "2.14.15rc1",
        "2.14.16",
        "2.14.16rc1",
        "2.14.17",
        "2.14.17rc1",
        "2.14.18",
        "2.14.18rc1",
        "2.14.1rc1",
        "2.14.2",
        "2.14.2rc1",
        "2.14.3",
        "2.14.3rc1",
        "2.14.4",
        "2.14.4rc1",
        "2.14.5",
        "2.14.5rc1",
        "2.14.6",
        "2.14.6rc1",
        "2.14.7",
        "2.14.7rc1",
        "2.14.8",
        "2.14.8rc1",
        "2.14.9",
        "2.14.9rc1",
        "2.15.0",
        "2.15.0b1",
        "2.15.0b2",
        "2.15.0b3",
        "2.15.0rc1",
        "2.15.0rc2",
        "2.15.1",
        "2.15.10",
        "2.15.10rc1",
        "2.15.11",
        "2.15.11rc1",
        "2.15.12",
        "2.15.12rc1",
        "2.15.13",
        "2.15.13rc1",
        "2.15.1rc1",
        "2.15.2",
        "2.15.2rc1",
        "2.15.3",
        "2.15.3rc1",
        "2.15.4",
        "2.15.4rc1",
        "2.15.5",
        "2.15.5rc1",
        "2.15.6",
        "2.15.6rc1",
        "2.15.7",
        "2.15.7rc1",
        "2.15.8",
        "2.15.9",
        "2.15.9rc1",
        "2.16.0",
        "2.16.0b1",
        "2.16.0b2",
        "2.16.0rc1",
        "2.16.1",
        "2.16.10",
        "2.16.10rc1",
        "2.16.11",
        "2.16.11rc1",
        "2.16.12",
        "2.16.12rc1",
        "2.16.13",
        "2.16.13rc1",
        "2.16.1rc1",
        "2.16.2",
        "2.16.3",
        "2.16.3rc1",
        "2.16.4",
        "2.16.4rc1",
        "2.16.5",
        "2.16.5rc1",
        "2.16.6",
        "2.16.7",
        "2.16.7rc1",
        "2.16.8",
        "2.16.8rc1",
        "2.16.9",
        "2.16.9rc1",
        "2.17.0",
        "2.17.0b1",
        "2.17.0rc1",
        "2.17.0rc2",
        "2.17.1",
        "2.17.1rc1",
        "2.17.2",
        "2.17.2rc1",
        "2.17.2rc2",
        "2.17.3",
        "2.17.3rc1",
        "2.17.4",
        "2.17.4rc1",
        "2.17.5",
        "2.17.5rc1",
        "2.17.6",
        "2.17.6rc1",
        "2.18.0",
        "2.18.0b1",
        "2.18.0rc1",
        "2.18.0rc2"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-11079",
    "GHSA-99w6-3xph-cx78"
  ],
  "details": "A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.",
  "id": "PYSEC-2026-1123",
  "modified": "2026-07-07T17:23:39.765410Z",
  "published": "2026-07-07T14:34:44.267867Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11079"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/pull/84299"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/pull/84339"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/commit/2936b80dbbc7efb889934aeec80f6142c10266ce"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/commit/70e83e72b43e05e57eb42a6d52d01a4d9768f510"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/commit/98774d15d7748ebaaaf2e83942cc7e8d39f7280e"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:10770"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:11145"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-11079"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325171"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/ansible/ansible"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ansible/ansible/blob/v2.18.1/changelogs/CHANGELOG-v2.18.rst#security-fixes"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2026/03/msg00006.html"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/ansible-core"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-99w6-3xph-cx78"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Ansible-Core vulnerable to content protections bypass"
}

RHSA-2024:10770

Vulnerability from csaf_redhat - Published: 2024-12-03 22:38 - Updated: 2026-06-30 03:04

Summary

Red Hat Security Advisory: Red Hat Ansible Automation Platform Execution Environments Container Release Update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2024-11079.

CVE-2024-11079

5.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Fixed: 45 products

https://access.redhat.com/errata/RHSA-2024:10770

Open the full advisory

RHSA-2024:11145

Vulnerability from csaf_redhat - Published: 2024-12-16 18:56 - Updated: 2026-06-30 03:04

Summary

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2024-11079.

CVE-2024-11079

5.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Fixed: 12 products Known not affected: 66 products

https://access.redhat.com/errata/RHSA-2024:11145

Open the full advisory

RHSA-2024_10770

Vulnerability from csaf_redhat - Published: 2024-12-03 22:38 - Updated: 2024-12-18 03:58

Summary

Red Hat Security Advisory: Red Hat Ansible Automation Platform Execution Environments Container Release Update

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2024-11079.

CVE-2024-11079

5.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Fixed: 45 products

https://access.redhat.com/errata/RHSA-2024:10770

Open the full advisory

RHSA-2024_11145

Vulnerability from csaf_redhat - Published: 2024-12-16 18:56 - Updated: 2024-12-18 05:22

Summary

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Severity

Moderate

Scope

2 vulnerabilities in this advisory, including CVE-2024-11079.

CVE-2024-11079

5.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Fixed: 12 products Known not affected: 70 products

https://access.redhat.com/errata/RHSA-2024:11145

Open the full advisory

ubuntu-cve-2024-11079

Vulnerability from osv_ubuntu

Published

2024-11-12 00:15

Modified

2026-05-20 15:07

Summary

Details

Severity

5.5 (Medium)


                    
                      CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

N/A (UNKNOWN)

low

References

URL

Type

	https://ubuntu.com/security/CVE-2024-11079	REPORT
	https://www.cve.org/CVERecord?id=CVE-2024-11079	REPORT
	https://access.redhat.com/security/cve/CVE-2024-11079	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2325171	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ansible",
            "binary_version": "1.5.4+dfsg-1ubuntu0.1~esm3"
          },
          {
            "binary_name": "ansible-fireball",
            "binary_version": "1.5.4+dfsg-1ubuntu0.1~esm3"
          },
          {
            "binary_name": "ansible-node-fireball",
            "binary_version": "1.5.4+dfsg-1ubuntu0.1~esm3"
          }
        ],
        "priority_reason": "Upstream rates this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:14.04:LTS",
        "name": "ansible",
        "purl": "pkg:deb/ubuntu/ansible@1.5.4+dfsg-1ubuntu0.1~esm3?arch=source\u0026distro=esm-infra-legacy/trusty"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.1+dfsg-1",
        "1.3.4+dfsg-1",
        "1.4.0+dfsg-1",
        "1.4.1+dfsg-1",
        "1.4.3+dfsg-1",
        "1.4.4+dfsg-1",
        "1.5.4+dfsg-1",
        "1.5.4+dfsg-1ubuntu0.1~esm1",
        "1.5.4+dfsg-1ubuntu0.1~esm2",
        "1.5.4+dfsg-1ubuntu0.1~esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ansible",
            "binary_version": "2.0.0.2-2ubuntu1.3+esm6"
          },
          {
            "binary_name": "ansible-fireball",
            "binary_version": "2.0.0.2-2ubuntu1.3+esm6"
          },
          {
            "binary_name": "ansible-node-fireball",
            "binary_version": "2.0.0.2-2ubuntu1.3+esm6"
          }
        ],
        "priority_reason": "Upstream rates this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:16.04:LTS",
        "name": "ansible",
        "purl": "pkg:deb/ubuntu/ansible@2.0.0.2-2ubuntu1.3+esm6?arch=source\u0026distro=esm-apps/xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.9.2+dfsg-2",
        "1.9.4-1",
        "2.0.0.2-2",
        "2.0.0.2-2ubuntu1",
        "2.0.0.2-2ubuntu1.1",
        "2.0.0.2-2ubuntu1.2",
        "2.0.0.2-2ubuntu1.3",
        "2.0.0.2-2ubuntu1.3+esm1",
        "2.0.0.2-2ubuntu1.3+esm2",
        "2.0.0.2-2ubuntu1.3+esm3",
        "2.0.0.2-2ubuntu1.3+esm4",
        "2.0.0.2-2ubuntu1.3+esm5",
        "2.0.0.2-2ubuntu1.3+esm6"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ansible",
            "binary_version": "2.5.1+dfsg-1ubuntu0.1+esm5"
          }
        ],
        "priority_reason": "Upstream rates this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:18.04:LTS",
        "name": "ansible",
        "purl": "pkg:deb/ubuntu/ansible@2.5.1+dfsg-1ubuntu0.1+esm5?arch=source\u0026distro=esm-apps/bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.3.1.0+dfsg-2",
        "2.5.0+dfsg-1",
        "2.5.1+dfsg-1",
        "2.5.1+dfsg-1ubuntu0.1",
        "2.5.1+dfsg-1ubuntu0.1+esm1",
        "2.5.1+dfsg-1ubuntu0.1+esm2",
        "2.5.1+dfsg-1ubuntu0.1+esm3",
        "2.5.1+dfsg-1ubuntu0.1+esm4",
        "2.5.1+dfsg-1ubuntu0.1+esm5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ansible",
            "binary_version": "2.9.6+dfsg-1ubuntu0.1~esm3"
          }
        ],
        "priority_reason": "Upstream rates this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:20.04:LTS",
        "name": "ansible",
        "purl": "pkg:deb/ubuntu/ansible@2.9.6+dfsg-1ubuntu0.1~esm3?arch=source\u0026distro=esm-apps/focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.8.3+dfsg-1",
        "2.8.6+dfsg-1",
        "2.9.2+dfsg-1",
        "2.9.4+dfsg-1",
        "2.9.6+dfsg-1",
        "2.9.6+dfsg-1ubuntu0.1~esm1",
        "2.9.6+dfsg-1ubuntu0.1~esm2",
        "2.9.6+dfsg-1ubuntu0.1~esm3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ansible-core",
            "binary_version": "2.12.0-1ubuntu0.1"
          }
        ],
        "priority_reason": "Upstream rates this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "ansible-core",
        "purl": "pkg:deb/ubuntu/ansible-core@2.12.0-1ubuntu0.1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.12.0-1",
        "2.12.0-1ubuntu0.1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ansible",
            "binary_version": "2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4"
          }
        ],
        "priority_reason": "Upstream rates this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:Pro:22.04:LTS",
        "name": "ansible",
        "purl": "pkg:deb/ubuntu/ansible@2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4?arch=source\u0026distro=esm-apps/jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.10.7+merged+base+2.10.8+dfsg-1",
        "2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm1",
        "2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ansible",
            "binary_version": "9.2.0+dfsg-0ubuntu5"
          }
        ],
        "priority_reason": "Upstream rates this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "ansible",
        "purl": "pkg:deb/ubuntu/ansible@9.2.0+dfsg-0ubuntu5?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "7.7.0+dfsg-1",
        "7.7.0+dfsg-3",
        "9.2.0+dfsg-0ubuntu4",
        "9.2.0+dfsg-0ubuntu5"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ansible-core",
            "binary_version": "2.16.3-0ubuntu2"
          }
        ],
        "priority_reason": "Upstream rates this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "ansible-core",
        "purl": "pkg:deb/ubuntu/ansible-core@2.16.3-0ubuntu2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.14.9-2",
        "2.14.11-1",
        "2.14.11-2",
        "2.14.13-1",
        "2.16.3-0ubuntu1",
        "2.16.3-0ubuntu2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ansible",
            "binary_version": "12.0.0~b1+dfsg-1"
          }
        ],
        "priority_reason": "Upstream rates this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "ansible",
        "purl": "pkg:deb/ubuntu/ansible@12.0.0~b1+dfsg-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "11.2.0+dfsg-1",
        "12.0.0~a2+dfsg-1",
        "12.0.0~a4+dfsg-1",
        "12.0.0~a6+dfsg-1",
        "12.0.0~b1+dfsg-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ansible-core",
            "binary_version": "2.19.0-1ubuntu1"
          }
        ],
        "priority_reason": "Upstream rates this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "ansible-core",
        "purl": "pkg:deb/ubuntu/ansible-core@2.19.0-1ubuntu1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.18.1-4ubuntu1",
        "2.19.0~beta4-1ubuntu1",
        "2.19.0-1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ansible",
            "binary_version": "13.1.0+dfsg-1ubuntu1"
          }
        ],
        "priority_reason": "Upstream rates this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "ansible",
        "purl": "pkg:deb/ubuntu/ansible@13.1.0+dfsg-1ubuntu1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "12.0.0~b1+dfsg-1",
        "12.0.0+dfsg-1",
        "12.2.0+dfsg-1",
        "13.1.0+dfsg-1",
        "13.1.0+dfsg-1ubuntu1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "ansible-core",
            "binary_version": "2.20.1-1"
          }
        ],
        "priority_reason": "Upstream rates this as being low severity"
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "ansible-core",
        "purl": "pkg:deb/ubuntu/ansible-core@2.20.1-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.19.0-1ubuntu1",
        "2.19.4-1",
        "2.20.1-1"
      ]
    }
  ],
  "aliases": [],
  "details": "A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.",
  "id": "UBUNTU-CVE-2024-11079",
  "modified": "2026-05-20T15:07:30Z",
  "published": "2024-11-12T00:15:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2024-11079"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-11079"
    },
    {
      "type": "REPORT",
      "url": "https://access.redhat.com/security/cve/CVE-2024-11079"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325171"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "low",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2024-11079"
  ]
}

WID-SEC-W-2024-3404

Vulnerability from csaf_certbund - Published: 2024-11-11 23:00 - Updated: 2026-06-07 22:00

Summary

Ansible-Core: Schwachstelle ermöglicht Codeausführung

Severity

Mittel

Scope

1 vulnerability in this advisory, including CVE-2024-11079.

CVE-2024-11079

Known affected: 6 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2024-11079 (GCVE-0-2024-11079)

PYSEC-2026-1123

RHSA-2024:10770

RHSA-2024:11145

RHSA-2024_10770

RHSA-2024_11145

ubuntu-cve-2024-11079

Vulnerability from osv_ubuntu

WID-SEC-W-2024-3404

Tags

Sightings

Nomenclature