Metrics
Affected Vendors & Products
| Source | ID | Title |
|---|---|---|
EUVD |
EUVD-2024-3228 | A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks. |
Github GHSA |
GHSA-99w6-3xph-cx78 | Ansible-Core vulnerable to content protections bypass |
Solution
No solution given by the vendor.
Workaround
To mitigate this vulnerability, avoid using the hostvars object to reference content marked as !unsafe. Ensure that all remote data from modules or lookups is properly sanitized and validated before use in playbooks. Additionally, restrict access to inventory files and Ansible playbooks to trusted users to minimize exploitation risks.
Tue, 29 Jul 2025 09:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat ansible Core
|
|
| CPEs | cpe:/a:redhat:ansible_core:2::el8 cpe:/a:redhat:ansible_core:2::el9 |
|
| Vendors & Products |
Redhat ansible Core
|
Sat, 05 Jul 2025 05:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat enterprise Linux
|
|
| CPEs | cpe:/o:redhat:enterprise_linux:10 | |
| Vendors & Products |
Redhat enterprise Linux
|
Wed, 18 Dec 2024 04:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat ansible Automation Platform Developer
Redhat ansible Automation Platform Inside |
|
| CPEs | cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8 cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8 cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9 |
|
| Vendors & Products |
Redhat ansible Automation Platform Developer
Redhat ansible Automation Platform Inside |
|
| References |
|
Tue, 17 Dec 2024 02:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:ansible_automation_platform:2.5::el8 cpe:/a:redhat:ansible_automation_platform:2.5::el9 |
Wed, 04 Dec 2024 01:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:ansible_automation_platform:ee::el8 cpe:/a:redhat:ansible_automation_platform:ee::el9 |
|
| References |
|
Tue, 12 Nov 2024 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Tue, 12 Nov 2024 01:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
| |
| Metrics |
threat_severity
|
threat_severity
|
Mon, 11 Nov 2024 23:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks. | |
| Title | Ansible-core: unsafe tagging bypass via hostvars object in ansible-core | |
| First Time appeared |
Redhat
Redhat ansible Automation Platform Redhat enterprise Linux Ai |
|
| Weaknesses | CWE-20 | |
| CPEs | cpe:/a:redhat:ansible_automation_platform:2 cpe:/a:redhat:enterprise_linux_ai:1 |
|
| Vendors & Products |
Redhat
Redhat ansible Automation Platform Redhat enterprise Linux Ai |
|
| References |
| |
| Metrics |
cvssV3_1
|
Status: PUBLISHED
Assigner: redhat
Published:
Updated: 2025-11-20T18:21:35.335Z
Reserved: 2024-11-11T11:57:21.806Z
Link: CVE-2024-11079
Updated: 2024-11-12T14:42:08.396Z
Status : Awaiting Analysis
Published: 2024-11-12T00:15:15.543
Modified: 2024-12-18T04:15:06.310
Link: CVE-2024-11079
OpenCVE Enrichment
No data.
EUVD
Github GHSA