CVE-2014-4657

Description

The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions.

Risk Information

Base Score

9.8

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

2.239

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2014-2686,CVE-2014-4657 are fixed in Python-ansible 1.5.4	Windows
Vulnerabilities CVE-2014-2686,CVE-2014-4657 are fixed in Python-ansible for linux 1.5.4	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234