CVE-2014-4678 — Vulnetix

Try Vulnetix Request Demo

CVE-2014-4678 PUBLISHED

The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.

EPSS 4.73% · 89.3th percentile

Risk Scores

EPSS Score

4.73%

89.3th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:Pro:14.04:LTS	ansible	0, 1.1+dfsg-1, 1.3.4+dfsg-1

Timeline

Feb 20, 2020 CVE Published
Feb 4, 2022 EPSS Score
Mar 28, 2022 EPSS Score
Jul 10, 2022 EPSS Score
Sep 1, 2022 EPSS Score
Oct 23, 2022 EPSS Score
Dec 14, 2022 EPSS Score
Mar 7, 2023 EPSS Score
Mar 8, 2023 EPSS Score
Mar 28, 2023 EPSS Score
May 8, 2023 EPSS Score
Jul 10, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2014-4678 third-party-advisory
https://github.com/ansible/ansible/commit/5429b85b9f6c2e640074176f36ff05fd5e4d1916 third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2014-4678 third-party-advisory

Open in Interactive Console →