What’s Vulnerable › Vulnerabilities

CVE-2023-5764: Ansible: template injection

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-12 · updated 2026-06-17
• Weakness: CWE-1336

Description

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.

Affected products

• Fedoraproject Extra Packages For Enterprise Linux: 8.0
• Fedoraproject Fedora: 38, 39
• Red Hat Ansible: before 2.14.12; from 2.15.0 before 2.15.7; 2.16.0, 2.16.0-beta1, 2.16.0-beta2, 2.16.0-rc1 — fixed in 2.14.12, 2.15.7
• Red Hat Ansible Automation Platform: 2.4
• RedHat Ansible Developer: 1.1
• RedHat Ansible Inside: 1.2

How to fix

Upgrade to a fixed version: Red Hat Ansible 2.14.12, 2.15.7. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2023:7773
• https://access.redhat.com/security/cve/CVE-2023-5764
• https://bugzilla.redhat.com/show_bug.cgi?id=2247629
• https://access.redhat.com/errata/RHSA-2023:7773
• https://access.redhat.com/security/cve/CVE-2023-5764
• https://bugzilla.redhat.com/show_bug.cgi?id=2247629
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7Q6CHPVCHMZS5M7V22GOKFSXZAQ24EU/
• https://security.netapp.com/advisory/ntap-20241025-0001/

Get alerted when CVE-2023-5764 or the next vulnerability affects your stack