ansible-4.10.0.tar.gz: 21 vulnerabilities (highest severity is: 7.8)

[mend-bolt-for-github]

Vulnerable Library - ansible-4.10.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/fd/f8/071905c6a67592d0852a9f340f6ab9226861eeeb97fdf4068642b22edcf3/ansible-4.10.0.tar.gz

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (ansible version)	Remediation Possible**
CVE-2026-16493	High	7.8	ansible-core-2.11.8.tar.gz	Transitive	N/A*	❌
CVE-2026-11332	High	7.8	ansible-core-2.11.8.tar.gz	Transitive	N/A*	❌
CVE-2026-69249	High	7.5	cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl	Transitive	N/A*	❌
CVE-2023-50782	High	7.5	cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl	Transitive	5.0.1	❌
CVE-2022-3697	High	7.5	ansible-4.10.0.tar.gz	Direct	ansible - 7.0.0,ansible - 7.0.0	❌
CVE-2023-0286	High	7.4	cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl	Transitive	N/A*	❌
CVE-2024-56326	High	7.3	Jinja2-3.0.3-py3-none-any.whl	Transitive	5.0.1	❌
CVE-2024-56201	High	7.3	Jinja2-3.0.3-py3-none-any.whl	Transitive	5.0.1	❌
CVE-2023-4237	High	7.3	ansible-core-2.11.8.tar.gz	Transitive	N/A*	❌
CVE-2023-5764	High	7.1	ansible-core-2.11.8.tar.gz	Transitive	5.0.1	❌
CVE-2024-9902	Medium	6.3	ansible-core-2.11.8.tar.gz	Transitive	5.0.1	❌
CVE-2023-5115	Medium	6.3	detected in multiple dependencies	Transitive	5.0.1	❌
CVE-2026-26007	Medium	5.9	cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl	Transitive	5.0.1	❌
CVE-2023-49083	Medium	5.9	cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl	Transitive	5.0.1	❌
CVE-2024-8775	Medium	5.5	ansible-core-2.11.8.tar.gz	Transitive	5.0.1	❌
CVE-2024-11079	Medium	5.5	ansible-core-2.11.8.tar.gz	Transitive	5.0.1	❌
CVE-2024-0727	Medium	5.5	cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl	Transitive	N/A*	❌
CVE-2024-22195	Medium	5.4	Jinja2-3.0.3-py3-none-any.whl	Transitive	5.0.1	❌
CVE-2024-0690	Medium	5.0	ansible-core-2.11.8.tar.gz	Transitive	N/A*	❌
CVE-2023-23931	Medium	4.8	cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl	Transitive	5.0.1	❌
CVE-2026-34073	Low	3.7	cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2026-16493

Vulnerable Library - ansible-core-2.11.8.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/2a/3f/74189f84fc9a4a203fc9644cd62146ba735fd9dd17f94867a272075c3cc7/ansible-core-2.11.8.tar.gz

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ❌ ansible-core-2.11.8.tar.gz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.

Publish Date: 2026-07-21

URL: CVE-2026-16493

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2026-11332

Vulnerable Library - ansible-core-2.11.8.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/2a/3f/74189f84fc9a4a203fc9644cd62146ba735fd9dd17f94867a272075c3cc7/ansible-core-2.11.8.tar.gz

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ❌ ansible-core-2.11.8.tar.gz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field. This allows arbitrary code execution on the machine of a user who installs the role via ansible-galaxy role install.

Publish Date: 2026-06-05

URL: CVE-2026-11332

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2026-69249

Vulnerable Library - cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/d8/0c/c0f8790bdeff9813722811500fd735c40a6c50fe0b4f8f6f4444f7a49cc0/cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ansible-core-2.11.8.tar.gz
    • ❌ cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.

Publish Date: 2026-08-03

URL: CVE-2026-69249

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-03

Fix Resolution: https://github.com/pyca/cryptography.git - 49.0.0

Step up your Open Source Security Game with Mend here

CVE-2023-50782

Vulnerable Library - cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/d8/0c/c0f8790bdeff9813722811500fd735c40a6c50fe0b4f8f6f4444f7a49cc0/cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ansible-core-2.11.8.tar.gz
    • ❌ cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.

Publish Date: 2024-02-05

URL: CVE-2023-50782

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3ww4-gg4f-jr7f

Release Date: 2024-02-05

Fix Resolution (cryptography): 42.0.0

Direct dependency fix Resolution (ansible): 5.0.1

Step up your Open Source Security Game with Mend here

CVE-2022-3697

Vulnerable Library - ansible-4.10.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/fd/f8/071905c6a67592d0852a9f340f6ab9226861eeeb97fdf4068642b22edcf3/ansible-4.10.0.tar.gz

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-4.10.0.tar.gz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A flaw was found in Ansible in the amazon.aws collection when using the tower_callback parameter from the amazon.aws.ec2_instance module. This flaw allows an attacker to take advantage of this issue as the module is handling the parameter insecurely, leading to the password leaking in the logs.

Publish Date: 2022-10-28

URL: CVE-2022-3697

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cpx3-93w7-457x

Release Date: 2022-10-28

Fix Resolution: ansible - 7.0.0,ansible - 7.0.0

Step up your Open Source Security Game with Mend here

CVE-2023-0286

Vulnerable Library - cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/d8/0c/c0f8790bdeff9813722811500fd735c40a6c50fe0b4f8f6f4444f7a49cc0/cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ansible-core-2.11.8.tar.gz
    • ❌ cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

There is a type confusion vulnerability relating to X.400 address processing
inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but
the public structure definition for GENERAL_NAME incorrectly specified the type
of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by
the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an
ASN1_STRING.
When CRL checking is enabled (i.e. the application sets the
X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass
arbitrary pointers to a memcmp call, enabling them to read memory contents or
enact a denial of service. In most cases, the attack requires the attacker to
provide both the certificate chain and CRL, neither of which need to have a
valid signature. If the attacker only controls one of these inputs, the other
input must already contain an X.400 address as a CRL distribution point, which
is uncommon. As such, this vulnerability is most likely to only affect
applications which have implemented their own functionality for retrieving CRLs
over a network.

Publish Date: 2023-02-08

URL: CVE-2023-0286

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-x4qr-2fvf-3mr5

Release Date: 2023-02-08

Fix Resolution: openssl-3.0.8;cryptography - 39.0.1;openssl-src - 111.25.0+1.1.1t,300.0.12+3.0.8,openssl - 1.1.1u,openssl - 3.0.9,openssl - 1.1.1u,openssl - 3.0.9

Step up your Open Source Security Game with Mend here

CVE-2024-56326

Vulnerable Library - Jinja2-3.0.3-py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/20/9a/e5d9ec41927401e41aea8af6d16e78b5e612bca4699d417f646a9610a076/Jinja2-3.0.3-py3-none-any.whl

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ansible-core-2.11.8.tar.gz
    • ❌ Jinja2-3.0.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python code. To exploit the vulnerability, an attacker needs to control the content of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates. Jinja's sandbox does catch calls to str.format and ensures they don't escape the sandbox. However, it's possible to store a reference to a malicious string's format method, then pass that to a filter that calls it. No such filters are built-in to Jinja, but could be present through custom filters in an application. After the fix, such indirect calls are also handled by the sandbox. This vulnerability is fixed in 3.1.5.

Publish Date: 2024-12-23

URL: CVE-2024-56326

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q2x7-8rv6-6q7h

Release Date: 2024-12-23

Fix Resolution (Jinja2): 3.1.5

Direct dependency fix Resolution (ansible): 5.0.1

Step up your Open Source Security Game with Mend here

CVE-2024-56201

Vulnerable Library - Jinja2-3.0.3-py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/20/9a/e5d9ec41927401e41aea8af6d16e78b5e612bca4699d417f646a9610a076/Jinja2-3.0.3-py3-none-any.whl

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ansible-core-2.11.8.tar.gz
    • ❌ Jinja2-3.0.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of if Jinja's sandbox is used. To exploit the vulnerability, an attacker needs to control both the filename and the contents of a template. Whether that is the case depends on the type of application using Jinja. This vulnerability impacts users of applications which execute untrusted templates where the template author can also choose the template filename. This vulnerability is fixed in 3.1.5.

Publish Date: 2024-12-23

URL: CVE-2024-56201

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gmj6-6f8f-6699

Release Date: 2024-12-23

Fix Resolution (Jinja2): 3.1.5

Direct dependency fix Resolution (ansible): 5.0.1

Step up your Open Source Security Game with Mend here

CVE-2023-4237

Vulnerable Library - ansible-core-2.11.8.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/2a/3f/74189f84fc9a4a203fc9644cd62146ba735fd9dd17f94867a272075c3cc7/ansible-core-2.11.8.tar.gz

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ❌ ansible-core-2.11.8.tar.gz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A flaw was found in the Ansible Automation Platform. When creating a new keypair, the ec2_key module prints out the private key directly to the standard output. This flaw allows an attacker to fetch those keys from the log files, compromising the system's confidentiality, integrity, and availability.

Publish Date: 2023-10-04

URL: CVE-2023-4237

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2023-5764

Vulnerable Library - ansible-core-2.11.8.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/2a/3f/74189f84fc9a4a203fc9644cd62146ba735fd9dd17f94867a272075c3cc7/ansible-core-2.11.8.tar.gz

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ❌ ansible-core-2.11.8.tar.gz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A template injection flaw was found in Ansible where a user's controller internal templating operations may remove the unsafe designation from template data. This issue could allow an attacker to use a specially crafted file to introduce templating injection when supplying templating data.

Publish Date: 2023-12-12

URL: CVE-2023-5764

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2023-5764

Release Date: 2023-12-12

Fix Resolution (ansible-core): 2.14.12

Direct dependency fix Resolution (ansible): 5.0.1

Step up your Open Source Security Game with Mend here

CVE-2024-9902

Vulnerable Library - ansible-core-2.11.8.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/2a/3f/74189f84fc9a4a203fc9644cd62146ba735fd9dd17f94867a272075c3cc7/ansible-core-2.11.8.tar.gz

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ❌ ansible-core-2.11.8.tar.gz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A flaw was found in Ansible. The ansible-core "user" module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the "user" module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-11-06

URL: CVE-2024-9902

CVSS 3 Score Details (6.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-11-06

Fix Resolution (ansible-core): 2.14.18

Direct dependency fix Resolution (ansible): 5.0.1

Step up your Open Source Security Game with Mend here

CVE-2023-5115

Vulnerable Libraries - ansible-core-2.11.8.tar.gz, ansible-4.10.0.tar.gz

ansible-core-2.11.8.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/2a/3f/74189f84fc9a4a203fc9644cd62146ba735fd9dd17f94867a272075c3cc7/ansible-core-2.11.8.tar.gz

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ❌ ansible-core-2.11.8.tar.gz (Vulnerable Library)

ansible-4.10.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/fd/f8/071905c6a67592d0852a9f340f6ab9226861eeeb97fdf4068642b22edcf3/ansible-4.10.0.tar.gz

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-4.10.0.tar.gz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.

Publish Date: 2023-12-18

URL: CVE-2023-5115

CVSS 3 Score Details (6.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-12-18

Fix Resolution (ansible-core): 2.13.13

Direct dependency fix Resolution (ansible): 5.0.1

Step up your Open Source Security Game with Mend here

CVE-2026-26007

Vulnerable Library - cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/d8/0c/c0f8790bdeff9813722811500fd735c40a6c50fe0b4f8f6f4444f7a49cc0/cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ansible-core-2.11.8.tar.gz
    • ❌ cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() and load_pem_public_key() functions do not verify that the point belongs to the expected prime-order subgroup of the curve. This missing validation allows an attacker to provide a public key point P from a small-order subgroup. This can lead to security issues in various situations, such as the most commonly used signature verification (ECDSA) and shared key negotiation (ECDH). When the victim computes the shared secret as S = [victim_private_key]P via ECDH, this leaks information about victim_private_key mod (small_subgroup_order). For curves with cofactor > 1, this reveals the least significant bits of the private key. When these weak public keys are used in ECDSA , it's easy to forge signatures on the small subgroup. Only SECT curves are impacted by this. This vulnerability is fixed in 46.0.5.

Publish Date: 2026-02-10

URL: CVE-2026-26007

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r6ph-v2qm-q3c2

Release Date: 2026-02-10

Fix Resolution (cryptography): 46.0.5

Direct dependency fix Resolution (ansible): 5.0.1

Step up your Open Source Security Game with Mend here

CVE-2023-49083

Vulnerable Library - cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/d8/0c/c0f8790bdeff9813722811500fd735c40a6c50fe0b4f8f6f4444f7a49cc0/cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ansible-core-2.11.8.tar.gz
    • ❌ cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Calling "load_pem_pkcs7_certificates" or "load_der_pkcs7_certificates" could lead to a NULL-pointer dereference and segfault. Exploitation of this vulnerability poses a serious risk of Denial of Service (DoS) for any application attempting to deserialize a PKCS7 blob/certificate. The consequences extend to potential disruptions in system availability and stability. This vulnerability has been patched in version 41.0.6.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2023-11-29

URL: CVE-2023-49083

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-49083

Release Date: 2023-11-29

Fix Resolution (cryptography): 41.0.6

Direct dependency fix Resolution (ansible): 5.0.1

Step up your Open Source Security Game with Mend here

CVE-2024-8775

Vulnerable Library - ansible-core-2.11.8.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/2a/3f/74189f84fc9a4a203fc9644cd62146ba735fd9dd17f94867a272075c3cc7/ansible-core-2.11.8.tar.gz

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ❌ ansible-core-2.11.8.tar.gz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as include_vars to load vaulted variables without setting the no_log: true parameter, resulting in sensitive data being printed in the playbook output or logs. This can lead to the unintentional disclosure of secrets like passwords or API keys, compromising security and potentially allowing unauthorized access or actions.

Publish Date: 2024-09-14

URL: CVE-2024-8775

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jpxc-vmjf-9fcj

Release Date: 2024-09-14

Fix Resolution (ansible-core): 2.16.14

Direct dependency fix Resolution (ansible): 5.0.1

Step up your Open Source Security Game with Mend here

CVE-2024-11079

Vulnerable Library - ansible-core-2.11.8.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/2a/3f/74189f84fc9a4a203fc9644cd62146ba735fd9dd17f94867a272075c3cc7/ansible-core-2.11.8.tar.gz

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ❌ ansible-core-2.11.8.tar.gz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playbooks.

Publish Date: 2024-11-11

URL: CVE-2024-11079

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2024-11079

Release Date: 2024-11-11

Fix Resolution (ansible-core): 2.16.14

Direct dependency fix Resolution (ansible): 5.0.1

Step up your Open Source Security Game with Mend here

CVE-2024-0727

Vulnerable Library - cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/d8/0c/c0f8790bdeff9813722811500fd735c40a6c50fe0b4f8f6f4444f7a49cc0/cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ansible-core-2.11.8.tar.gz
    • ❌ cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL
to crash leading to a potential Denial of Service attack
Impact summary: Applications loading files in the PKCS12 format from untrusted
sources might terminate abruptly.
A file in PKCS12 format can contain certificates and keys and may come from an
untrusted source. The PKCS12 specification allows certain fields to be NULL, but
OpenSSL does not correctly check for this case. This can lead to a NULL pointer
dereference that results in OpenSSL crashing. If an application processes PKCS12
files from an untrusted source using the OpenSSL APIs then that application will
be vulnerable to this issue.
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(),
PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()
and PKCS12_newpass().
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this
function is related to writing data we do not consider it security significant.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

Publish Date: 2024-01-26

URL: CVE-2024-0727

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://openssl-library.org/news/vulnerabilities/#CVE-2024-0727

Release Date: 2024-01-26

Fix Resolution: openssl - 1.1.1x,openssl - 3.0.13,openssl - 3.0.13,openssl - 3.1.5,openssl - 3.1.5,openssl - 3.2.1,openssl - 3.2.1,openssl - 1.1.1x,https://github.com/openssl/openssl.git - openssl-1.1.1x,https://github.com/openssl/openssl.git - openssl-3.1.5,https://github.com/openssl/openssl.git - openssl-3.2.1,https://github.com/openssl/openssl.git - openssl-3.0.13,https://github.com/openssl/openssl.git - openssl-1.0.2zj

Step up your Open Source Security Game with Mend here

CVE-2024-22195

Vulnerable Library - Jinja2-3.0.3-py3-none-any.whl

A very fast and expressive template engine.

Library home page: https://files.pythonhosted.org/packages/20/9a/e5d9ec41927401e41aea8af6d16e78b5e612bca4699d417f646a9610a076/Jinja2-3.0.3-py3-none-any.whl

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ansible-core-2.11.8.tar.gz
    • ❌ Jinja2-3.0.3-py3-none-any.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Jinja is an extensible templating engine. Special placeholders in the template allow writing code similar to Python syntax. It is possible to inject arbitrary HTML attributes into the rendered HTML template, potentially leading to Cross-Site Scripting (XSS). The Jinja "xmlattr" filter can be abused to inject arbitrary HTML attribute keys and values, bypassing the auto escaping mechanism and potentially leading to XSS. It may also be possible to bypass attribute validation checks if they are blacklist-based.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2024-01-11

URL: CVE-2024-22195

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h5c8-rqwp-cp95

Release Date: 2024-01-11

Fix Resolution (Jinja2): 3.1.3

Direct dependency fix Resolution (ansible): 5.0.1

Step up your Open Source Security Game with Mend here

CVE-2024-0690

Vulnerable Library - ansible-core-2.11.8.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/2a/3f/74189f84fc9a4a203fc9644cd62146ba735fd9dd17f94867a272075c3cc7/ansible-core-2.11.8.tar.gz

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ❌ ansible-core-2.11.8.tar.gz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may include sensitive information, such as decrypted secret values.

Publish Date: 2024-02-06

URL: CVE-2024-0690

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2024-0690

Release Date: 2024-02-06

Fix Resolution: ansible-core - 2.14.14,2.15.9,2.16.3

Step up your Open Source Security Game with Mend here

CVE-2023-23931

Vulnerable Library - cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/d8/0c/c0f8790bdeff9813722811500fd735c40a6c50fe0b4f8f6f4444f7a49cc0/cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ansible-core-2.11.8.tar.gz
    • ❌ cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In affected versions "Cipher.update_into" would accept Python objects which implement the buffer protocol, but provide only immutable buffers. This would allow immutable objects (such as "bytes") to be mutated, thus violating fundamental rules of Python and resulting in corrupted output. This now correctly raises an exception. This issue has been present since "update_into" was originally introduced in cryptography 1.8.

Publish Date: 2023-02-07

URL: CVE-2023-23931

CVSS 3 Score Details (4.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-23931

Release Date: 2023-02-07

Fix Resolution (cryptography): 39.0.1

Direct dependency fix Resolution (ansible): 5.0.1

Step up your Open Source Security Game with Mend here

CVE-2026-34073

Vulnerable Library - cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

cryptography is a package which provides cryptographic recipes and primitives to Python developers.

Library home page: https://files.pythonhosted.org/packages/d8/0c/c0f8790bdeff9813722811500fd735c40a6c50fe0b4f8f6f4444f7a49cc0/cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl

Sample Path to Dependency File: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ansible-4.10.0.tar.gz (Root Library)
  • ansible-core-2.11.8.tar.gz
    • ❌ cryptography-36.0.1-cp36-abi3-manylinux_2_24_x86_64.whl (Vulnerable Library)

Found in base branch: main

Vulnerability Details

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to version 46.0.6, DNS name constraints were only validated against SANs within child certificates, and not the "peer name" presented during each validation. Consequently, cryptography would allow a peer named bar.example.com to validate against a wildcard leaf certificate for *.example.com, even if the leaf's parent certificate (or upwards) contained an excluded subtree constraint for bar.example.com. This issue has been patched in version 46.0.6.

Publish Date: 2026-03-31

URL: CVE-2026-34073

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m959-cc7f-wv43

Release Date: 2026-03-31

Fix Resolution: cryptography - 46.0.6,cryptography - 46.0.6

Step up your Open Source Security Game with Mend here