CVE-2023-5764: Ansible template injection vulnerability
(updated )
A template injection flaw was found in Ansible where a user’s controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.
References
- access.redhat.com/errata/RHSA-2023:7773
- access.redhat.com/security/cve/CVE-2023-5764
- bugzilla.redhat.com/show_bug.cgi?id=2247629
- github.com/advisories/GHSA-7j69-qfc3-2fq9
- github.com/ansible/ansible
- github.com/ansible/ansible/commit/270b39f6ff02511a2199505161218cbd1a5ae34f
- github.com/ansible/ansible/commit/7239d2d371bc6e274cbb7314e01431adce6ae25a
- github.com/ansible/ansible/commit/fea130480d261ea5bf6fcd5cf19a348f1686ceb1
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7Q6CHPVCHMZS5M7V22GOKFSXZAQ24EU
- nvd.nist.gov/vuln/detail/CVE-2023-5764
Code Behaviors & Features
Detect and mitigate CVE-2023-5764 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →