Vulnerability · Published Nov 11, 2024 · Assigned by redhat
CVE-2024-11079Ansible-core: unsafe tagging bypass via hostvars object in ansible-core
Medium 5.5
In plain English
A medium-severity improper input validation in ansible-core. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.5%top 55.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ansible | 5.4.0-1 | DEBIAN-CVE-2024-11079 |
| Debian:13 | ansible | 5.4.0-1 | DEBIAN-CVE-2024-11079 |
| Debian:14 | ansible | 5.4.0-1 | DEBIAN-CVE-2024-11079 |
| Debian:12 | ansible-core | 2.14.18-0+deb12u1 | DEBIAN-CVE-2024-11079 |
| Debian:13 | ansible-core | 2.18.0-2 | DEBIAN-CVE-2024-11079 |
| Debian:14 | ansible-core | 2.18.0-2 | DEBIAN-CVE-2024-11079 |
| PyPI | ansible-core | 2.18.1rc1 | GHSA-99w6-3xph-cx78 |
| PyPI | ansible-core | 2.17.7rc1 | GHSA-99w6-3xph-cx78 |
| PyPI | ansible-core | 2.16.14rc1 | GHSA-99w6-3xph-cx78 |
| PyPI | ansible-core | 2.16.14rc1, 2.17.7rc1, 2.18.1rc1 | PYSEC-2026-1123 |
| Ubuntu:24.04:LTS | ansible | no fix listed | UBUNTU-CVE-2024-11079 |
| Ubuntu:25.10 | ansible | no fix listed | UBUNTU-CVE-2024-11079 |
| Ubuntu:26.04:LTS | ansible | no fix listed | UBUNTU-CVE-2024-11079 |
| Ubuntu:26.10 | ansible | no fix listed | UBUNTU-CVE-2024-11079 |
| Ubuntu:22.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2024-11079 |
| Ubuntu:24.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2024-11079 |
| Ubuntu:25.10 | ansible-core | no fix listed | UBUNTU-CVE-2024-11079 |
| Ubuntu:26.04:LTS | ansible-core | no fix listed | UBUNTU-CVE-2024-11079 |
| Ubuntu:26.10 | ansible-core | no fix listed | UBUNTU-CVE-2024-11079 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
References
- RHSA-2024:10770 vendor-advisory, x_refsource_REDHAT
- RHSA-2024:11145 vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2024-11079 vdb-entry, x_refsource_REDHAT
- RHBZ#2325171 issue-tracking, x_refsource_REDHAT
- https://lists.debian.org/debian-lts-announce/2026/03/msg00006.html