CVE-2023-5764 (High) detected in ansible-core-2.11.1.tar.gz

[mend-for-github-com]

CVE-2023-5764 - High Severity Vulnerability

Vulnerable Library - ansible-core-2.11.1.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/be/27/a4ee8ec50cdfa87385e1181da8bb4b3205d8e669d13393b747baaa01f45a/ansible-core-2.11.1.tar.gz

Path to dependency file: /packages/react-server-website/deployment/requirements.txt

Path to vulnerable library: /packages/react-server-website/deployment/requirements.txt

Dependency Hierarchy:

• ansible-4.0.0.tar.gz (Root Library)
  • ❌ ansible-core-2.11.1.tar.gz (Vulnerable Library)

Found in HEAD commit: fc4f63cd9d7cfd34b5d6322a49f9b670bd83cb27

Found in base branch: master

Vulnerability Details

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.

Publish Date: 2023-12-12

URL: CVE-2023-5764

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2023-5764

Release Date: 2023-12-12

Fix Resolution (ansible-core): 2.14.12

Direct dependency fix Resolution (ansible): 6.2.0

---

⛑️ Automatic Remediation will be attempted for this issue.