Key Information Vulnerability Description CVE Number: CVE-2024-11079 Public Disclosure Date: November 11, 2024 Last Modified Date: November 11, 2024 Impact Level: Medium CVSS v3 Score: 5.5 Vulnerability Details Description: A flaw has been identified in Ansible-Core. This vulnerability allows an attacker to bypass insecure content protection by referencing templated content via the object. If remote data or module output in playbooks is not properly templated, this could lead to arbitrary code execution. Mitigation Measures Avoid using the object to reference content marked as insecure. Ensure remote data retrieved from modules or lookups is properly sanitized and validated. Restrict access to inventory files and Ansible playbooks to trusted users only, to minimize exploitation risk. Additional Information Bugzilla: 2325171 - ansible-core: Insecure templating bypass via hostvars object in Ansible-Core CWE-20: Improper Input Validation FAQ: Frequently Asked Questions about CVE-2024-11079 Affected Packages and Red Hat Security Patches Affected Packages: - Red Hat Ansible Automation Platform 2 - Red Hat Enterprise Linux AI (RHEL AI) - Red Hat Enterprise Linux AI (RHEL AI) CVSS v3 Score Details CVSS v3 Base Score: 5.5 Attack Vector: Network Attack Complexity: High Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality Impact: Low Integrity Impact: Low Availability Impact: Low Frequently Asked Questions Why does Red Hat’s CVSS v3 score or impact differ from other vendors? If my product is listed as “under investigation” or “affected,” when will Red Hat release a fix? If my product is listed as “unfixable,” what should I do? What are mitigation measures? I have a Red Hat product, but it’s not listed above—am I affected? Why does my security scanner report my product is affected by this vulnerability, even though my product version is patched or unaffected? Copyright and Update Information This page is automatically generated by Red Hat and has not been checked for errors or omissions. Last Modified Date: November 11, 2024 CVE Description Copyright © 2021