ByteOS Network

NVD Vulnerability Details :

CVE-2017-2809

Modified

Source-talos-cna@cisco.com

Published At-14 Sep, 2017 | 19:29

Updated At-13 May, 2026 | 00:24

An exploitable vulnerability exists in the yaml loading functionality of ansible-vault before 1.0.5. A specially crafted vault can execute arbitrary python commands resulting in command execution. An attacker can insert python into the vault to trigger this vulnerability.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.0	7.5	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	3.0	7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

Type: Secondary

Version: 3.0

Base score: 7.5

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 3.0

Base score: 7.8

Base severity: HIGH

Vector:

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 6.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

ansible-vault_project>>ansible-vault>>Versions up to 1.0.4(inclusive)

cpe:2.3:a:ansible-vault_project:ansible-vault:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-94	Primary	nvd@nist.gov

CWE ID: CWE-94

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
http://www.securityfocus.com/bid/100824	talos-cna@cisco.com	Third Party Advisory VDB Entry
https://github.com/tomoh1r/ansible-vault/blob/v1.0.5/CHANGES.txt	talos-cna@cisco.com	Third Party Advisory
https://github.com/tomoh1r/ansible-vault/commit/3f8f659ef443ab870bb19f95d43543470168ae04	talos-cna@cisco.com	Third Party Advisory
https://github.com/tomoh1r/ansible-vault/issues/4	talos-cna@cisco.com	Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0305	talos-cna@cisco.com	Exploit Third Party Advisory
http://www.securityfocus.com/bid/100824	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory VDB Entry
https://github.com/tomoh1r/ansible-vault/blob/v1.0.5/CHANGES.txt	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://github.com/tomoh1r/ansible-vault/commit/3f8f659ef443ab870bb19f95d43543470168ae04	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://github.com/tomoh1r/ansible-vault/issues/4	af854a3a-2127-422b-91ae-364da2661108	Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0305	af854a3a-2127-422b-91ae-364da2661108	Exploit Third Party Advisory