This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-4041 →

DEBIAN-CVE-2021-4041

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to par...

Original description

The description as published by the source.

A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 ansible-runner

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]

Debian:13 ansible-runner

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]

Debian:14 ansible-runner

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-1"}]}]

References

advisory security-tracker.debian.org