What’s Vulnerable › Vulnerabilities

CVE-2017-2809

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-09-14 · updated 2026-06-17
• Weakness: CWE-94

Description

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability.

Affected products

• Tomohiro Nakamura ansible-vault: through 1.0.4

References

• http://www.securityfocus.com/bid/100824
• https://github.com/tomoh1r/ansible-vault/blob/v1.0.5/CHANGES.txt
• https://github.com/tomoh1r/ansible-vault/commit/3f8f659ef443ab870bb19f95d43543470168ae04
• https://github.com/tomoh1r/ansible-vault/issues/4
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0305
• http://www.securityfocus.com/bid/100824
• https://github.com/tomoh1r/ansible-vault/blob/v1.0.5/CHANGES.txt
• https://github.com/tomoh1r/ansible-vault/commit/3f8f659ef443ab870bb19f95d43543470168ae04
• https://github.com/tomoh1r/ansible-vault/issues/4
• https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0305

Get alerted when CVE-2017-2809 or the next vulnerability affects your stack