CVE:CVE-2017-7481
CNNVD:CNNVD-201705-1220
Ansible是美国Ansible公司的一款计算机系统配置管理器，它可用于发布、管理和编排计算机系统。
Ansible 2.3.1.0版本和2.4.0.0版本中存在输入验证漏洞，该漏洞源于程序没有正确地将lookup-plugin的查询结果标为不安全。远程攻击者可通过控制‘lookup()’函数调用的结果利用该漏洞注入Unicode字符串，执行代码。
solution:Upgrade redhat openshift_container_platform to a higher version than 3.3,3.4,3.5,and avoid the version 3.3,3.4,3.5; Upgrade redhat openstack to a higher version than 10,11,and avoid the version 10,11; Upgrade redhat storage_console to a higher version than 2.0,and avoid the version 2.0; Upgrade redhat virtualization to a higher version than 4.1,and avoid the version 4.1; Upgrade redhat virtualization_manager to a higher version than 4.1,and avoid the version 4.1; Upgrade redhat gluster_storage to a higher version than 3.2,and avoid the version 3.2; Upgrade redhat ansible_engine to a higher version than 2.3.1.0,2.4.0.0,and avoid the version (,2.3.1.0),[2.3.2.0,2.4.0.0); Upgrade canonical ubuntu_linux to a higher version than 16.04,18.04,19.04,and avoid the version 16.04,18.04,19.04; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0