Vulnerability	Vulnerable Version
H Arbitrary Argument Injection ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy. Affected versions of this package are vulnerable to Arbitrary Argument Injection. The `ansible-galaxy` role install command processes dependency specifications from a role's `meta/requirements.yml` file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the `src` field. This allows arbitrary code execution on the machine of a user who installs the role via `ansible-galaxy` role install. How to fix Arbitrary Argument Injection? Upgrade `ansible-core` to version 2.21.1rc1 or higher.	[,2.21.1rc1)

Arbitrary Argument Injection

ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load balancers easy.

Affected versions of this package are vulnerable to Arbitrary Argument Injection. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.

How to fix Arbitrary Argument Injection?

Upgrade ansible-core to version 2.21.1rc1 or higher.

[,2.21.1rc1)

Go back to all versions of this package