Vulnerability · Published Dec 12, 2023 · Assigned by redhat
CVE-2023-5764Ansible: template injection
High 7.1
In plain English
A high-severity security flaw in Red Hat Ansible Automation Platform 1.2 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 48% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ansible | 5.4.0-1 | DEBIAN-CVE-2023-5764 |
| Debian:13 | ansible | 5.4.0-1 | DEBIAN-CVE-2023-5764 |
| Debian:14 | ansible | 5.4.0-1 | DEBIAN-CVE-2023-5764 |
| Debian:12 | ansible-core | 2.14.16-0+deb12u1 | DEBIAN-CVE-2023-5764 |
| Debian:13 | ansible-core | 2.14.13-1 | DEBIAN-CVE-2023-5764 |
| Debian:14 | ansible-core | 2.14.13-1 | DEBIAN-CVE-2023-5764 |
| PyPI | ansible-core | 2.16.1 | GHSA-7j69-qfc3-2fq9 |
| PyPI | ansible-core | 2.15.8 | GHSA-7j69-qfc3-2fq9 |
| PyPI | ansible-core | 2.14.12 | GHSA-7j69-qfc3-2fq9 |
| PyPI | ansible-core | 2.14.12, 2.15.8, 2.16.1 | PYSEC-2026-1122 |
| Ubuntu:22.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2023-5764 |
| Ubuntu:24.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2023-5764 |
| Ubuntu:25.10 | ansible-core | no fix listed | UBUNTU-CVE-2023-5764 |
| Ubuntu:26.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2023-5764 |
| Ubuntu:26.10 | ansible-core | no fix listed | UBUNTU-CVE-2023-5764 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 9 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 9 | see references |
| Red Hat | Red Hat Ansible Automation Platform 2.4 for RHEL 9 | see references |
| Red Hat | Red Hat Ansible Automation Platform 1.2 | see references |
Weakness: CWE-1336 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- RHSA-2023:7773 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2023-5764 vdb-entry, x_refsource_REDHAT
- RHBZ#2247629 issue-tracking, x_refsource_REDHAT
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7Q6CHPVCHMZS5M7V22GOKFSXZAQ24EU/ x_transferred
- https://security.netapp.com/advisory/ntap-20241025-0001/