CVE-2014-4678 (Python, published 2020-02-20T03:15Z)
Description: value: The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-4657.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/ansible/ansible
Files changed:
lib/ansible/constants.py
lib/ansible/utils/__init__.py
Commit message: Change safe_eval to a strict white list


Vulnerable code:
def get_config(p, section, key, env_var, default, boolean=False, integer=False, floating=False):
DEFAULT_SU_EXE = get_config(p, DEFAULTS, 'su_exe', 'ANSIBLE_SU_EXE', 'su')
DEFAULT_SU = get_config(p, DEFAULTS, 'su', 'ANSIBLE_SU', False, boolean=True)
DEFAULT_SU_FLAGS = get_config(p, DEFAULTS, 'su_flags', 'ANSIBLE_SU_FLAGS', '')
DEFAULT_SU_USER = get_config(p, DEFAULTS, 'su_user', 'ANSIBLE_SU_USER', 'root')
DEFAULT_ASK_SU_PASS = get_config(p, DEFAULTS, 'ask_su_pass', 'ANSIBLE_ASK_SU_PASS', False, boolean=True)
DEFAULT_GATHERING = get_config(p, DEFAULTS, 'gathering', 'ANSIBLE_GATHERING', 'implicit').lower()
    # builtin functions that are not safe to call
    INVALID_CALLS = (
       'classmethod', 'compile', 'delattr', 'eval', 'execfile', 'file',
       'filter', 'help', 'input', 'object', 'open', 'raw_input', 'reduce',
       'reload', 'repr', 'setattr', 'staticmethod', 'super', 'type',
    )
                #raise Exception("invalid expression (%s) type=%s" % (expr, type(node)))
            if call.func.id in INVALID_CALLS:

Fixed code:
def get_config(p, section, key, env_var, default, boolean=False, integer=False, floating=False, islist=False):
    if value and islist:
        return [x.strip() for x in value.split(',')]
DEFAULT_SU_EXE            = get_config(p, DEFAULTS, 'su_exe', 'ANSIBLE_SU_EXE', 'su')
DEFAULT_SU                = get_config(p, DEFAULTS, 'su', 'ANSIBLE_SU', False, boolean=True)
DEFAULT_SU_FLAGS          = get_config(p, DEFAULTS, 'su_flags', 'ANSIBLE_SU_FLAGS', '')
DEFAULT_SU_USER           = get_config(p, DEFAULTS, 'su_user', 'ANSIBLE_SU_USER', 'root')
DEFAULT_ASK_SU_PASS       = get_config(p, DEFAULTS, 'ask_su_pass', 'ANSIBLE_ASK_SU_PASS', False, boolean=True)
DEFAULT_GATHERING         = get_config(p, DEFAULTS, 'gathering', 'ANSIBLE_GATHERING', 'implicit').lower()
DEFAULT_CALLABLE_WHITELIST     = get_config(p, DEFAULTS, 'callable_whitelist', 'ANSIBLE_CALLABLE_WHITELIST', [], islist=True)
    # builtin functions that are safe to call
    BUILTIN_WHITELIST = [
        'abs', 'all', 'any', 'basestring', 'bin', 'bool', 'buffer', 'bytearray',
        'bytes', 'callable', 'chr', 'cmp', 'coerce', 'complex', 'copyright', 'credits',
        'dict', 'dir', 'divmod', 'enumerate', 'exit', 'float', 'format', 'frozenset',
        'getattr', 'globals', 'hasattr', 'hash', 'hex', 'id', 'int', 'intern',
        'isinstance', 'issubclass', 'iter', 'len', 'license', 'list', 'locals', 'long',
        'map', 'max', 'memoryview', 'min', 'next', 'oct', 'ord', 'pow', 'print',
        'property', 'quit', 'range', 'reversed', 'round', 'set', 'slice', 'sorted',
        'str', 'sum', 'tuple', 'unichr', 'unicode', 'vars', 'xrange', 'zip',
    ]

    filter_list = []
    for filter in filter_loader.all():
        filter_list.extend(filter.filters().keys())

    CALL_WHITELIST = BUILTIN_WHITELIST + filter_list + C.DEFAULT_CALLABLE_WHITELIST
            if call.func.id not in CALL_WHITELIST: