CVE-2021-4041 (Python, published 2022-08-24T16:15Z)
Description: value: A flaw was found in ansible-runner. An improper escaping of the shell command, while calling the ansible_runner.interface.run_command, can lead to parameters getting executed as host's shell command. A developer could unintentionally write code that gets executed in the host rather than the virtual environment.
Severity: nan (CVSS v3 base score: 7.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/ansible/ansible-runner
Files changed:
ansible_runner/config/doc.py
ansible_runner/runner.py
test/integration/test_interface.py
test/unit/config/test_doc.py
Commit message: Remove shell use in subprocess

Co-authored-by: Sam Doran <sdoran@redhat.com>


Vulnerable code:
        self.cmdline_args.append(" ".join(plugin_names))
            cmd = 'cgcreate -a {user}:{group} -t {user}:{group} -g cpuacct,memory,pids:{}'.format(cgroup_path, user=user, group=group)
            proc = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True)
                    'shell': True
                proc_out = run_subprocess(" ".join(command), **kwargs)
            cmd = 'cgdelete -g cpuacct,memory,pids:{}'.format(cgroup_path)
            proc = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True)
            cmd = '{} kill {}'.format(container_cli, container_name)
            proc = Popen(cmd, stdout=PIPE, stderr=PIPE, shell=True)
    expected_command = [get_executable_path('ansible-doc'), '-s', '-t', 'module', '--playbook-dir', '/tmp/test', 'copy file']
        'copy '

Fixed code:
        self.cmdline_args.extend(plugin_names)
            cmd = ['cgcreate',
                   '-a', f'{user}:{group}',
                   '-t', f'{user}:{group}',
                   '-g', f'cpuacct,memory,pids:{cgroup_path}',
                   ]
            proc = Popen(cmd, stdout=PIPE, stderr=PIPE)
                proc_out = run_subprocess(command, **kwargs)
            cmd = ['cgdelete', '-g', f'cpuacct,memory,pids:{cgroup_path}']
            proc = Popen(cmd, stdout=PIPE, stderr=PIPE)
            cmd = [container_cli, 'kill', container_name]
            proc = Popen(cmd, stdout=PIPE, stderr=PIPE)
def test_run_command_injection_error():
    out, err, rc = run_command(
        executable_cmd='whoami',
        cmdline_args=[';hostname'],
        runner_mode='subprocess',
    )
    assert rc == 1
    assert "usage: whoami" in err or "whoami: extra operand ‘;hostname’" in err


@pytest.mark.test_all_runtimes
def test_run_command_injection_error_within_container(runtime):
    out, err, rc = run_command(
        executable_cmd='whoami',
        cmdline_args=[';hostname'],
        runner_mode='subprocess',
        process_isolation_executable=runtime,
        process_isolation=True,
        container_image=defaults.default_container_image,
    )
    assert rc == 1
    assert "whoami: extra operand ';hostname'" in err


    expected_command = [get_executable_path('ansible-doc'), '-s', '-t', 'module', '--playbook-dir', '/tmp/test', 'copy', 'file']
        'copy',