CVE-2024-11079
Full vulnerability record from the local CVENow database.
Description
A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Deferred
Source identifier
Published
2024-11-12 00:15:15.543000
Last modified
2026-11-05 12:17:44.287000
View original CVE JSON
{
"id": "CVE-2024-11079",
"sourceIdentifier": "[email protected]",
"published": "2024-11-12T00:15:15.543",
"lastModified": "2026-11-05T12:17:44.287",
"vulnStatus": "Deferred",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks."
},
{
"lang": "es",
"value": "Se encontró una falla en Ansible-Core. Esta vulnerabilidad permite a los atacantes eludir las protecciones de contenido inseguro mediante el objeto hostvars para hacer referencia y ejecutar contenido con plantilla. Este problema puede provocar la ejecución de código arbitrario si los datos remotos o las salidas de módulos tienen plantillas incorrectas dentro de los playbooks."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"defaultStatus": "unaffected",
"collectionURL": "https://github.com/ansible/ansible",
"packageName": "ansible-core",
"versions": [
{
"version": "0",
"lessThanOrEqual": "2.18.0",
"versionType": "semver",
"status": "affected"
}
]
},
{
"vendor": "Red Hat",
"product": "Ansible Automation Platform Execution Environments",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "ansible-automation-platform/ansible-builder-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_core:2::el8",
"cpe:/a:redhat:ansible_core:2::el9"
],
"versions": [
{
"version": "1.2.0-93",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Ansible Automation Platform Execution Environments",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "ansible-automation-platform/ansible-builder-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_core:2::el8",
"cpe:/a:redhat:ansible_core:2::el9"
],
"versions": [
{
"version": "3.0.1-108",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Ansible Automation Platform Execution Environments",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "ansible-automation-platform/ee-29-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_core:2::el8",
"cpe:/a:redhat:ansible_core:2::el9"
],
"versions": [
{
"version": "2.9.27-34",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Ansible Automation Platform Execution Environments",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "ansible-automation-platform/ee-minimal-rhel8",
"cpes": [
"cpe:/a:redhat:ansible_core:2::el8",
"cpe:/a:redhat:ansible_core:2::el9"
],
"versions": [
{
"version": "2.12.10-56",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Ansible Automation Platform Execution Environments",
"defaultStatus": "affected",
"collectionURL": "https://catalog.redhat.com/software/containers/",
"packageName": "ansible-automation-platform/ee-minimal-rhel9",
"cpes": [
"cpe:/a:redhat:ansible_core:2::el8",
"cpe:/a:redhat:ansible_core:2::el9"
],
"versions": [
{
"version": "2.15.13-4",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-core",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"versions": [
{
"version": "1:2.16.14-1.el8ap",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-core",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"versions": [
{
"version": "1:2.16.14-1.el8ap",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 8",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-core",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"versions": [
{
"version": "1:2.16.14-1.el8ap",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-core",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"versions": [
{
"version": "1:2.16.14-1.el9ap",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-core",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"versions": [
{
"version": "1:2.16.14-1.el9ap",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Ansible Automation Platform 2.5 for RHEL 9",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-core",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_developer:2.5::el9",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el8",
"cpe:/a:redhat:ansible_automation_platform_inside:2.5::el9"
],
"versions": [
{
"version": "1:2.16.14-1.el9ap",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"defaultStatus": "unaffected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "ansible-core",
"cpes": [
"cpe:/a:redhat:enterprise_linux:10"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/bootc-azure-nvidia-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux AI (RHEL AI)",
"defaultStatus": "affected",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rhelai1/bootc-nvidia-rhel9",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:1"
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "LOW"
},
"exploitabilityScore": 1.3,
"impactScore": 3.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2024-11-12T14:41:52.352926Z",
"id": "CVE-2024-11079",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"references": [
{
"url": "https://access.redhat.com/errata/RHSA-2024:10770",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/errata/RHSA-2024:11145",
"source": "[email protected]"
},
{
"url": "https://access.redhat.com/security/cve/CVE-2024-11079",
"source": "[email protected]"
},
{
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2325171",
"source": "[email protected]"
},
{
"url": "https://lists.debian.org/debian-lts-announce/2026/03/msg00006.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
]
}