Description
Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be parsed by the jinja2 templating system, resulting in code execution. By default, the jinja2 templating language is now marked as 'unsafe' and is not evaluated.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| [UNKNOWN] | ansible | ansible 2.3.1.0, ansible 2.4.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ansible | 2.3.1.0+dfsg-1 | — |
| Debian 13 | ansible | 2.3.1.0+dfsg-1 | — |
| Debian 12 | ansible | 2.3.1.0+dfsg-1 | — |
| Debian 9 | ansible | 2.2.1.0-2+deb9u2 | DLA-2535-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | ansible | 2.5.1+dfsg-1ubuntu0.1 | USN-4072-1 |
| Ubuntu 16.04 LTS | ansible | 2.0.0.2-2ubuntu1.3 | USN-4072-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhscon 2 | ansible | 2.2.3.0-1.el7 | RHSA-2017:1499 |
| Red Hat Rhev Manager 4 | ansible +1 | 2.3.1.0-3.el7 | RHSA-2017:2524 |
| Red Hat OpenStack 11 | ansible | 2.2.3.0-1.el7 | RHSA-2017:1476 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 10 | ansible | 2.2.3.0-1.el7 | RHSA-2017:1599 |
| Red Hat OpenShift 3 | ansible | 2.2.3.0-1.el7 | RHSA-2017:1244 |
| Red Hat OpenShift 3 | openshift-ansible +6 | 3.2.56-1.git.0.b844ab7.el7 | RHSA-2017:1244 |
| Red Hat OpenShift 3 | openshift-ansible-callback-plugins | 3.3.82-1.git.0.af0c922.el7 | RHSA-2017:1244 |
| Red Hat Gluster Storage 3 | ansible | 2.2.3.0-1.el7 | RHSA-2017:1334 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 | ansible | 2.7.6-bp150.3.3.1 | openSUSE-SU-2019:0238-1 |
| SUSE Package Hub 12 | ansible | 2.4.1.0-6.1 | openSUSE-SU-2017:2978-1, openSUSE-SU-2017:2976-1 |
| SUSE OpenStack Cloud 7 | ansible | 2.2.3.0-5.1 | SUSE-SU-2017:3029-1 |
| SUSE OpenStack Cloud 7 | monasca-installer | 20170912_10.45-5.1 | SUSE-SU-2017:3029-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ansible-10 | 10.6.0-1.1 | openSUSE-SU-2024:14536-1 |
| openSUSE Tumbleweed | ansible-11 | 11.11.0-1.1 | openSUSE-SU-2025:15605-1 |
| openSUSE Tumbleweed | ansible-12 | 12.2.0-1.1 | openSUSE-SU-2025:15753-1 |
| openSUSE Tumbleweed | ansible-13 | 13.7.0-1.1 | openSUSE-SU-2026:10944-1 |
| openSUSE Tumbleweed | ansible-14 | 14.6.0-1.1 | openSUSE-SU-2026:12447-1 |
| openSUSE Tumbleweed | ansible-9 | 9.8.0-1.1 | openSUSE-SU-2024:14244-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | ansible | >= 2.3.0.0, < 2.3.1.0 | 2.3.1.0 | GHSA-w578-j992-554x |
| PyPI | ansible | < 2.1.6.0 | 2.1.6.0 | GHSA-w578-j992-554x |
| PyPI | ansible | >= 2.2.0.0, < 2.2.3.0 | 2.2.3.0 | GHSA-w578-j992-554x |
| PyPI | ansible | < 2.3.1.0 · >= 2.3.2.0, < 2.4.0.0 | 2.3.1.0, 2.4.0.0 | PYSEC-2018-41 |
Advisories 19
- openSUSE-SU-2026:12447-1 ansible-14-14.6.0-1.1 on GA media SUSE / openSUSE Security Updates · Nov 7, 2026
- RHSA-2017:2524 Red Hat Security Advisory: ansible security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:1599 Red Hat Security Advisory: ansible security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:1499 Red Hat Security Advisory: ansible security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:1476 Red Hat Security Advisory: ansible security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:1334 Red Hat Security Advisory: ansible security update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2017:1244 Red Hat Security Advisory: ansible and openshift-ansible security and bug fix update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- WID-SEC-2026-1808 Red Hat OpenShift Container Platform: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit den Rechten des Dienstes BSI CERT-Bund (WID) · Jun 7, 2026
- openSUSE-SU-2026:10944-1 ansible-13-13.7.0-1.1 on GA media SUSE / openSUSE Security Updates · Jun 4, 2026
- USN-4072-1 ansible vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2025:15605-1 ansible-11-11.11.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- DLA-2535-1 ansible - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2017:2978-1 Security update for ansible SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2017:3029-1 Security update for ansible and monasca-installer SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2017:2976-1 Security update for ansible SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15753-1 ansible-12-12.2.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2019:0238-1 Security update for ansible SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14536-1 ansible-10-10.6.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14244-1 ansible-9-9.8.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- RHSA-2017:1599 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7481
- RHSA-2017:1334 vendor-advisory
- 98492 vdb-entry
- https://github.com/ansible/ansible/commit/ed56f51f185a1ffd7ea57130d260098686fcc7c2
- RHSA-2017:1244 vendor-advisory
- RHSA-2017:1499 vendor-advisory
- RHSA-2017:2524 vendor-advisory
- RHSA-2017:1476 vendor-advisory
- USN-4072-1 vendor-advisory
- [debian-lts-announce] 20210127 [SECURITY] [DLA 2535-1] ansible security update mailing-list