0022 CVE 2024 11079.patch | (download) |
changelogs/fragments/unsafe_hostvars_fix.yml |
2 2 + 0 - 0 !
lib/ansible/template/__init__.py |
31 1 + 30 - 0 !
lib/ansible/template/native_helpers.py |
122 118 + 4 - 0 !
lib/ansible/vars/hostvars.py |
7 4 + 3 - 0 !
test/integration/targets/template/cve-2024-11079.yml |
30 30 + 0 - 0 !
test/integration/targets/template/runme.sh |
4 4 + 0 - 0 !
6 files changed, 159 insertions(+), 37 deletions(-) |
fix cve-2024-11079 hostvars unsafe context
This vulnerability allows attackers to bypass unsafe content protections using
the hostvars object to reference and execute templated content. This issue can
lead to arbitrary code execution if remote data or module outputs are
improperly templated within playbooks.
.
This patch is based on the backport of the patch to ansible-core 2.16
|