CVE & CISA-KEV Catalog

CVE-2023-5764

HIGH
7.1
CVSS v3
NVD

Description

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.

CWE-1336

How to fix

Remediation Available
ansibleDebian
Fixed in:2.10.7+merged+base+2.10.17+dfsg-0+deb11u1CVE-2023-5764
Fixed in:5.4.0-1CVE-2023-5764
Fixed in:5.4.0-1CVE-2023-5764
Fixed in:5.4.0-1CVE-2023-5764
ansible-coreRocky
Fixed in:1:2.15.8-1.el8apRHSA-2023:7773
Fixed in:1:2.15.8-1.el8apRHSA-2023:7773
Fixed in:1:2.15.8-1.el9apRHSA-2023:7773
Fixed in:1:2.15.8-1.el9apRHSA-2023:7773
ansible-coreRed Hat / RHEL
Fixed in:1:2.15.8-1.el8apRHSA-2023:7773
Fixed in:1:2.15.8-1.el8apRHSA-2023:7773
Fixed in:1:2.15.8-1.el9apRHSA-2023:7773
Fixed in:1:2.15.8-1.el9apRHSA-2023:7773
ansible-testRocky
Fixed in:1:2.15.8-1.el8apRHSA-2023:7773
Fixed in:1:2.15.8-1.el9apRHSA-2023:7773
ansible-testRed Hat / RHEL
Fixed in:1:2.15.8-1.el8apRHSA-2023:7773
Fixed in:1:2.15.8-1.el9apRHSA-2023:7773
python-galaxy-importerRocky
Fixed in:0:0.4.18-1.el9apRHSA-2023:7773
python-galaxy-importerRed Hat / RHEL
Fixed in:0:0.4.18-1.el9apRHSA-2023:7773
python3-galaxy-importerRocky
Fixed in:0:0.4.18-1.el9apRHSA-2023:7773
python3-galaxy-importerRed Hat / RHEL
Fixed in:0:0.4.18-1.el9apRHSA-2023:7773
python39-galaxy-importerRocky
Fixed in:0:0.4.18-1.el8apRHSA-2023:7773
python39-galaxy-importerRed Hat / RHEL
Fixed in:0:0.4.18-1.el8apRHSA-2023:7773
python3x-galaxy-importerRed Hat / RHEL
Fixed in:0:0.4.18-1.el8apRHSA-2023:7773
python3x-galaxy-importerRocky
Fixed in:0:0.4.18-1.el8apRHSA-2023:7773
ansibleUbuntu
Fixed in:2.0.0.2-2ubuntu1.3+esm2USN-6846-1
Fixed in:2.5.1+dfsg-1ubuntu0.1+esm2USN-6846-1
Fixed in:2.9.6+dfsg-1ubuntu0.1~esm2USN-6846-1
Fixed in:2.10.7+merged+base+2.10.8+dfsg-1ubuntu0.1~esm4USN-6846-1

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorLocal
Attack ComplexityLow
Privileges RequiredLow
User InteractionNone
ScopeUnchanged

Impact

ConfidentialityHigh
IntegrityHigh
AvailabilityNone

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Exploit Intelligence

0.54%probability of exploitation in 30 days
41stpercentile

Moderate risk: more likely to be exploited than 41% of all known CVEs.

References

Embed a live status badge for CVE-2023-5764
CVE-2023-5764 severity badge

Markdown

[![CVE-2023-5764](https://tridentstack.com/cve/badge/CVE-2023-5764.svg)](https://tridentstack.com/cve/CVE-2023-5764)

HTML

<a href="https://tridentstack.com/cve/CVE-2023-5764"><img src="https://tridentstack.com/cve/badge/CVE-2023-5764.svg" alt="CVE-2023-5764"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

Start free

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.