Code Injection in Ansible - CVE-2021-3583

Vulnerability identifier: #VU54626

CSH Severity: High

CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-3583

CWE-ID: CWE-94

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing yaml multi-line strings with ansible facts in templates. A remote attacker can trick the victim to open a specially crafted yaml template and execute arbitrary commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Ansible
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Module for SUSE Manager Proxy
SUSE Linux Enterprise Module for SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Server
SUSE Manager Client Tools Beta for SLE Micro
SUSE Linux Enterprise Micro
Fedora
HPE Helion Openstack
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
SUSE Manager Tools
SUSE Linux Enterprise Server for SAP Applications
SUSE Manager Client Tools Beta for SLE
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Server for SAP
openSUSE Leap
openEuler
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Elastic Storage System
Ansible Automation Platform
Red Hat OpenShift Container Platform
rhc-catalog-worker (Red Hat package)
firewalld-prometheus-config
dracut-saltboot
python-ruamel-yaml-clib (Red Hat package)
python38-requirements-parser (Red Hat package)
python-galaxy-importer (Red Hat package)
golang-github-QubitProducts-exporter_exporter
python-sqlparse (Red Hat package)
python-colorama (Red Hat package)
python3-gnupg (Red Hat package)
python-inflection (Red Hat package)
wire
wire-debuginfo
python-ptyprocess (Red Hat package)
python-django-currentuser (Red Hat package)
python-resolvelib (Red Hat package)
python-aiofiles (Red Hat package)
python-mccabe (Red Hat package)
python-defusedxml (Red Hat package)
python-pulp-ansible (Red Hat package)
python-prometheus-client (Red Hat package)
python-dataclasses (Red Hat package)
python-drf-access-policy (Red Hat package)
python-commonmark (Red Hat package)
python-django-lifecycle (Red Hat package)
prometheus-postgres_exporter
python-lockfile (Red Hat package)
python-drf-spectacular (Red Hat package)
python-ecdsa (Red Hat package)
python-docutils (Red Hat package)
tini (Red Hat package)
python-ruamel-yaml (Red Hat package)
python-pyrsistent (Red Hat package)
python-future (Red Hat package)
prometheus-blackbox_exporter
python-drf-nested-routers (Red Hat package)
receptor (Red Hat package)
ansible-navigator (Red Hat package)
python-djangorestframework-queryfields (Red Hat package)
golang-github-lusitaniae-apache_exporter-debuginfo
golang-github-lusitaniae-apache_exporter
ansible-builder (Red Hat package)
python-et-xmlfile (Red Hat package)
python-asyncio-throttle (Red Hat package)
python-async-lru (Red Hat package)
python-meld3 (Red Hat package)
python-bleach-allowlist (Red Hat package)
zypp-plugin-spacewalk
python3-zypp-plugin-spacewalk
python38-onigurumacffi (Red Hat package)
python38-importlib-resources (Red Hat package)
python-idna-ssl (Red Hat package)
python3-markupsafe (Red Hat package)
supportutils-plugin-salt
pulpcore-selinux (Red Hat package)
dumb-init (Red Hat package)
python-enrich (Red Hat package)
python-xlwt (Red Hat package)
golang-github-prometheus-node_exporter
python-urlman (Red Hat package)
python-odfpy (Red Hat package)
python-pyjwkest (Red Hat package)
python-url-normalize (Red Hat package)
sshpass (Red Hat package)
python-yarl (Red Hat package)
golang-github-boynux-squid_exporter-debuginfo
golang-github-boynux-squid_exporter
python-importlib-metadata (Red Hat package)
python-rq (Red Hat package)
python-pyjwt (Red Hat package)
python-backoff (Red Hat package)
python-markuppy (Red Hat package)
python-cffi (Red Hat package)
python-six (Red Hat package)
python-urllib3 (Red Hat package)
python-aiodns (Red Hat package)
ansible-runner (Red Hat package)
python-xlrd (Red Hat package)
python-django-prometheus (Red Hat package)
python-bracex (Red Hat package)
python-daemon (Red Hat package)
python-django-guid (Red Hat package)
python3-django (Red Hat package)
python-django-guardian (Red Hat package)
python-pyflakes (Red Hat package)
python2-hwdata
python3-hwdata
python-django-filter (Red Hat package)
python-pygtrie (Red Hat package)
python-pyparsing (Red Hat package)
python-django-import-export (Red Hat package)
python-pulp-container (Red Hat package)
ansible
ansible-help
python38-dateutil (Red Hat package)
python-pycodestyle (Red Hat package)
python-pygments (Red Hat package)
python3-semantic-version (Red Hat package)
python-psycopg2 (Red Hat package)
ansible-doc
ansible-test
python-idna (Red Hat package)
ansible-core (Red Hat package)
python3-jinja2 (Red Hat package)
python-pycparser (Red Hat package)
python-requests (Red Hat package)
golang-github-prometheus-prometheus
python-tablib (Red Hat package)
python-uritemplate (Red Hat package)
python-async-timeout (Red Hat package)
python-openpyxl (Red Hat package)
python-pycares (Red Hat package)
python-dynaconf (Red Hat package)
python-jsonschema (Red Hat package)
python-bleach (Red Hat package)
python-markdown (Red Hat package)
helm (Red Hat package)
python-zipp (Red Hat package)
python-redis (Red Hat package)
python-aiohttp (Red Hat package)
python-typing-extensions (Red Hat package)
python-typing (Red Hat package)
python-flake8 (Red Hat package)
python-pycryptodomex (Red Hat package)
python-pulpcore (Red Hat package)
python-djangorestframework (Red Hat package)
automation-controller (Red Hat package)
supervisor (Red Hat package)
python-galaxy-ng (Red Hat package)
automation-hub (Red Hat package)
python3-uyuni-common-libs
mgr-daemon
uyuni-proxy-systemd-services
mgr-virtualization-host
python3-mgr-virtualization-host
python3-mgr-virtualization-common
spacewalk-client-setup
spacewalk-client-tools
python3-spacewalk-check
spacewalk-check
python3-spacewalk-client-tools
python3-spacewalk-client-setup
spacecmd
python-pexpect (Red Hat package)
mgr-push
python3-mgr-push
supportutils-plugin-susemanager-client
python3-rhnlib
ansible-lint (Red Hat package)
python-multidict (Red Hat package)
python-whitenoise (Red Hat package)
python-pyyaml (Red Hat package)
python-pbr (Red Hat package)
python3-pyvmomi
oniguruma (Red Hat package)
python-tenacity (Red Hat package)
python38-click (Red Hat package)
python3-click (Red Hat package)
python-wcmatch (Red Hat package)
grafana
grafana-debuginfo
python-rich (Red Hat package)
python-pyOpenSSL (Red Hat package)
python-gunicorn (Red Hat package)
python3x-pip (Red Hat package)
python-packaging (Red Hat package)
python-attrs (Red Hat package)
python-certifi (Red Hat package)
python-pytz (Red Hat package)
python-diff-match-patch (Red Hat package)

Install updates from vendor's website.

Ansible - addressed in versions 2.9.23, 2.9.23-1.el8ap
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - addressed in versions 4.5.1, 4.8.0
Red Hat OpenShift Container Platform - update to 4.6.38
IBM Elastic Storage System - addressed in versions 6.0.2.4, 6.1.2.2
rhc-catalog-worker (Red Hat package) - update to 0.1.6-2.el8ap
firewalld-prometheus-config - update to 0.1-159000.6.33.1
dracut-saltboot - addressed in versions 0.1.1657643023.0d694ce-150000.1.35.1, 0.1.1681904360.84ef141-159000.3.30.1
python-ruamel-yaml-clib (Red Hat package) - update to 0.2.0-2.el8pc
python38-requirements-parser (Red Hat package) - update to 0.2.0-3.el8ap
python-galaxy-importer (Red Hat package) - update to 0.3.2-1.el8pc
golang-github-QubitProducts-exporter_exporter - addressed in versions 0.4.0-150000.1.15.1, 0.4.0-159000.4.6.1
python-sqlparse (Red Hat package) - update to 0.4.1-1.el8pc
python-colorama (Red Hat package) - update to 0.4.4-1.el8pc
python3-gnupg (Red Hat package) - update to 0.4.7-1.el8pc
python-inflection (Red Hat package) - update to 0.5.0-1.el8pc
wire - update to 0.5.0-150000.1.6.1
wire-debuginfo - update to 0.5.0-150000.1.6.1
python-ptyprocess (Red Hat package) - update to 0.5.2-4.el8ap
python-django-currentuser (Red Hat package) - update to 0.5.3-1.el8pc
python-resolvelib (Red Hat package) - update to 0.5.4-4.el8ap
python-aiofiles (Red Hat package) - update to 0.6.0-1.el8pc
python-mccabe (Red Hat package) - update to 0.6.1-1.el8pc
python-defusedxml (Red Hat package) - update to 0.7.1-1.el8pc
python-pulp-ansible (Red Hat package) - update to 0.7.3-1.el8pc
python-prometheus-client (Red Hat package) - update to 0.8.0-1.el8pc
python-dataclasses (Red Hat package) - update to 0.8-1.el8pc
python-drf-access-policy (Red Hat package) - update to 0.8.7-1.el8pc
python-commonmark (Red Hat package) - update to 0.9.1-1.el8pc
python-django-lifecycle (Red Hat package) - update to 0.9.1-1.el8pc
prometheus-postgres_exporter - update to 0.10.1-159000.3.6.1
python-lockfile (Red Hat package) - update to 0.11.0-9.el8ap
python-drf-spectacular (Red Hat package) - update to 0.13.2-1.el8pc
python-ecdsa (Red Hat package) - update to 0.13.3-2.el8pc
python-docutils (Red Hat package) - update to 0.14-7.el8ap
tini (Red Hat package) - update to 0.16.1-1.el8at
python-ruamel-yaml (Red Hat package) - update to 0.16.10-1.el8pc
python-pyrsistent (Red Hat package) - update to 0.17.3-1.el8pc
python-future (Red Hat package) - update to 0.18.2-3.el8pc
prometheus-blackbox_exporter - addressed in versions 0.19.0-150000.1.11.1, 0.24.0-159000.3.6.1
python-drf-nested-routers (Red Hat package) - update to 0.93.3-1.el8pc
receptor (Red Hat package) - update to 1.0.0-1.el8ap
ansible-navigator (Red Hat package) - update to 1.0.0-2.el8ap
python-djangorestframework-queryfields (Red Hat package) - update to 1.0.0-3.el8pc
golang-github-lusitaniae-apache_exporter-debuginfo - update to 1.0.0-159000.4.12.1
golang-github-lusitaniae-apache_exporter - update to 1.0.0-159000.4.12.1
ansible-builder (Red Hat package) - update to 1.0.1-1.el8ap
python-et-xmlfile (Red Hat package) - update to 1.0.1-1.el8pc
python-asyncio-throttle (Red Hat package) - update to 1.0.2-1.el8pc
python-async-lru (Red Hat package) - update to 1.0.2-1.el8pc
python-meld3 (Red Hat package) - update to 1.0.2-10.el8at
python-bleach-allowlist (Red Hat package) - update to 1.0.3-1.el8pc
zypp-plugin-spacewalk - update to 1.0.13-150000.3.32.1
python3-zypp-plugin-spacewalk - update to 1.0.13-150000.3.32.1
python38-onigurumacffi (Red Hat package) - update to 1.1.0-1.el8ap
python38-importlib-resources (Red Hat package) - update to 1.1.0-2.el8ap
python-idna-ssl (Red Hat package) - update to 1.1.0-3.el8pc
python3-markupsafe (Red Hat package) - update to 1.1.1-4.el8pc
supportutils-plugin-salt - update to 1.2.2-159000.5.9.1
pulpcore-selinux (Red Hat package) - update to 1.2.4-1.el8pc
dumb-init (Red Hat package) - update to 1.2.5-1.el8ap
python-enrich (Red Hat package) - update to 1.2.6-1.el8pc
python-xlwt (Red Hat package) - update to 1.3.0-1.el8pc
golang-github-prometheus-node_exporter - update to 1.3.0-150000.3.15.1
python-urlman (Red Hat package) - update to 1.4.0-1.el8pc
python-odfpy (Red Hat package) - update to 1.4.1-2.el8pc
python-pyjwkest (Red Hat package) - update to 1.4.2-2.el8pc
python-url-normalize (Red Hat package) - update to 1.4.3-2.el8pc
sshpass (Red Hat package) - update to 1.06-3.el8ae
python-yarl (Red Hat package) - update to 1.6.3-1.el8pc
golang-github-boynux-squid_exporter-debuginfo - update to 1.6-159000.4.9.1
golang-github-boynux-squid_exporter - update to 1.6-159000.4.9.1
python-importlib-metadata (Red Hat package) - update to 1.7.0-1.el8pc
python-rq (Red Hat package) - update to 1.7.0-2.el8pc
python-pyjwt (Red Hat package) - update to 1.7.1-3.el8pc
python-backoff (Red Hat package) - update to 1.10.0-3.el8pc
python-markuppy (Red Hat package) - update to 1.14-1.el8pc
python-cffi (Red Hat package) - update to 1.14.5-1.el8pc
python-six (Red Hat package) - update to 1.15.0-1.el8pc
python-urllib3 (Red Hat package) - update to 1.26.4-1.el8pc
Ansible Automation Platform - update to 2.0.0
python-aiodns (Red Hat package) - update to 2.0.0-3.el8pc
ansible-runner (Red Hat package) - update to 2.0.1-1.el8ap
python-xlrd (Red Hat package) - update to 2.0.1-1.el8pc
python-django-prometheus (Red Hat package) - update to 2.1.0-1.el8pc
python-bracex (Red Hat package) - update to 2.1.1-1.el8pc
python-daemon (Red Hat package) - update to 2.1.2-10.el8ap
python-django-guid (Red Hat package) - update to 2.2.1-1.el8pc
python3-django (Red Hat package) - update to 2.2.23-1.el8pc
python-django-guardian (Red Hat package) - update to 2.3.0-1.el8pc
python-pyflakes (Red Hat package) - update to 2.3.1-1.el8pc
python2-hwdata - update to 2.3.5-150000.3.9.1
python3-hwdata - addressed in versions 2.3.5-150000.3.9.1, 2.3.5-159000.5.13.1
python-django-filter (Red Hat package) - update to 2.4.0-1.el8pc
python-pygtrie (Red Hat package) - update to 2.4.2-1.el8pc
python-pyparsing (Red Hat package) - update to 2.4.7-1.el8pc
python-django-import-export (Red Hat package) - update to 2.5.0-1.el8pc
python-pulp-container (Red Hat package) - update to 2.5.3-1.el8pc
ansible - update to 2.5.5-9
ansible-help - update to 2.5.5-9
python38-dateutil (Red Hat package) - update to 2.6.1-8.el8ap
python-pycodestyle (Red Hat package) - update to 2.7.0-1.el8pc
python-pygments (Red Hat package) - update to 2.8.1-1.el8pc
python3-semantic-version (Red Hat package) - update to 2.8.5-3.el8pc
python-psycopg2 (Red Hat package) - update to 2.8.6-1.el8pc
ansible - addressed in versions 2.9.23-1.el7, 2.9.23-1.el8, 2.9.23-1.fc33, 2.9.23-1.fc34
ansible - addressed in versions 2.9.27-3.21.1, 2.9.27-150000.1.14.1, 2.9.27-159000.3.9.1
ansible-doc - addressed in versions 2.9.27-150000.1.14.1, 2.9.27-159000.3.9.1
ansible-test - update to 2.9.27-150000.1.14.1
python-idna (Red Hat package) - update to 2.10-1.el8pc
ansible-core (Red Hat package) - update to 2.11.2-2.el8ap
python3-jinja2 (Red Hat package) - update to 2.11.3-1.el8pc
python-pycparser (Red Hat package) - update to 2.20-1.el8pc
python-requests (Red Hat package) - update to 2.25.1-1.el8pc
golang-github-prometheus-prometheus - update to 2.45.0-159000.6.33.1
python-tablib (Red Hat package) - update to 3.0.0-1.el8pc
python-uritemplate (Red Hat package) - update to 3.0.1-2.el8pc
python-async-timeout (Red Hat package) - update to 3.0.1-2.el8pc
python-openpyxl (Red Hat package) - update to 3.0.7-1.el8pc
python-pycares (Red Hat package) - update to 3.1.1-2.el8pc
python-dynaconf (Red Hat package) - update to 3.1.4-1.el8pc
python-jsonschema (Red Hat package) - update to 3.2.0-4.el8pc
python-bleach (Red Hat package) - update to 3.3.0-1.el8pc
python-markdown (Red Hat package) - update to 3.3.4-1.el8pc
helm (Red Hat package) - update to 3.3.4-2.el8at
python-zipp (Red Hat package) - update to 3.4.0-2.el8pc
python-redis (Red Hat package) - update to 3.5.3-1.el8pc
python-aiohttp (Red Hat package) - update to 3.7.4-1.el8pc
python-typing-extensions (Red Hat package) - update to 3.7.4.3-1.el8pc
python-typing (Red Hat package) - update to 3.7.4.3-1.el8pc
python-flake8 (Red Hat package) - update to 3.9.2-1.el8pc
python-pycryptodomex (Red Hat package) - update to 3.10.1-1.el8pc
python-pulpcore (Red Hat package) - update to 3.11.2-2.el8pc
python-djangorestframework (Red Hat package) - update to 3.12.4-1.el8pc
automation-controller (Red Hat package) - update to 4.0.0-1.el8ap
supervisor (Red Hat package) - update to 4.2.1-1.el8at
python-galaxy-ng (Red Hat package) - update to 4.3.2-1.el8pc
automation-hub (Red Hat package) - update to 4.3.2-1.el8pc
python3-uyuni-common-libs - addressed in versions 4.3.5-150000.1.24.1, 5.0.1-159000.3.33.1
mgr-daemon - update to 4.3.5-150000.1.35.1
uyuni-proxy-systemd-services - addressed in versions 4.3.6-150000.1.6.1, 5.0.1-159000.3.9.1
mgr-virtualization-host - update to 4.3.6-150000.1.32.1
python3-mgr-virtualization-host - update to 4.3.6-150000.1.32.1
python3-mgr-virtualization-common - update to 4.3.6-150000.1.32.1
spacewalk-client-setup - addressed in versions 4.3.11-150000.3.65.1, 5.0.1-159000.6.48.1
spacewalk-client-tools - addressed in versions 4.3.11-150000.3.65.1, 5.0.1-159000.6.48.1
python3-spacewalk-check - addressed in versions 4.3.11-150000.3.65.1, 5.0.1-159000.6.48.1
spacewalk-check - addressed in versions 4.3.11-150000.3.65.1, 5.0.1-159000.6.48.1
python3-spacewalk-client-tools - addressed in versions 4.3.11-150000.3.65.1, 5.0.1-159000.6.48.1
python3-spacewalk-client-setup - addressed in versions 4.3.11-150000.3.65.1, 5.0.1-159000.6.48.1
spacecmd - addressed in versions 4.3.14-150000.3.83.1, 5.0.1-159000.6.42.1
python-pexpect (Red Hat package) - update to 4.6-3.el8ap
mgr-push - update to 5.0.1-159000.4.21.1
python3-mgr-push - update to 5.0.1-159000.4.21.1
supportutils-plugin-susemanager-client - update to 5.0.1-159000.6.15.1
python3-rhnlib - update to 5.0.1-159000.6.30.1
ansible-lint (Red Hat package) - update to 5.0.8-1.el8pc
python-multidict (Red Hat package) - update to 5.1.0-1.el8pc
python-whitenoise (Red Hat package) - update to 5.2.0-1.el8pc
python-pyyaml (Red Hat package) - update to 5.4.1-1.el8pc
python-pbr (Red Hat package) - update to 5.5.1-6.el8ap
python3-pyvmomi - update to 6.7.3-159000.3.6.1
oniguruma (Red Hat package) - update to 6.9.7.1-1.el8ap
python-tenacity (Red Hat package) - update to 7.0.0-1.el8pc
python38-click (Red Hat package) - update to 7.1.2-3.el8ap
python3-click (Red Hat package) - update to 7.1.2-3.el8pc
python-wcmatch (Red Hat package) - update to 8.1.2-1.el8pc
grafana - update to 9.5.8-159000.4.24.1
grafana-debuginfo - update to 9.5.8-159000.4.24.1
python-rich (Red Hat package) - update to 10.0.1-1.el8pc
python-pyOpenSSL (Red Hat package) - update to 19.1.0-1.el8pc
python-gunicorn (Red Hat package) - update to 20.0.4-2.el8pc
python3x-pip (Red Hat package) - update to 20.2.4-4.el8
python-packaging (Red Hat package) - update to 20.9-1.el8pc
python-attrs (Red Hat package) - update to 21.2.0-1.el8pc
python-certifi (Red Hat package) - update to 2020.6.20-1.el8pc
python-pytz (Red Hat package) - update to 2021.1-1.el8pc
python-diff-match-patch (Red Hat package) - update to 20200713-1.el8pc

• https://github.com/ansible/ansible/blob/v2.9.23/changelogs/CHANGELOG-v2.9.rst#security-fixes
• https://bugzilla.redhat.com/show_bug.cgi?id=1968412

• Template injection in Ansible
• Template injection in Red Hat Ansible Engine
• Multiple vulnerabilities in OpenShift Container Platform 4.6
• IBM Elastic Storage System update for Ansible
• SUSE update for ansible
• Remote code execution in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• SUSE update for Important for SUSE Manager Client Tools
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• SUSE update for Security Beta update for SUSE Manager Client Tools and Salt
• Code Injection in Ansible Automation Platform 2.0 packages
• Fedora EPEL 7 update for ansible
• Fedora 33 update for ansible
• Fedora EPEL 8 update for ansible
• Fedora 34 update for ansible
• openEuler 20.03 LTS SP4 update for ansible