CVE-2024-11079
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A flaw in Ansible-Core allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content, leading to arbitrary code execution.
Risk Assessment
The risk for the organization includes potential compromise of systems managed by Ansible if remote data or module outputs are improperly templated within playbooks.
Recommendation
Immediately update Ansible-Core to the latest patched version and review playbooks for secure handling of input data.
Original NVD description (English source)
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.