{
  "cveId": "CVE-2021-3583",
  "url": "https://patchblox.com/security/cve/CVE-2021-3583",
  "summary": "CVE-2021-3583 is fixed in ansible on 1 platform, first by ansible 2.5.1\u002Bdfsg-1ubuntu0.1\u002Besm1, released September 22, 2021. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "ansible: A flaw was found in Ansible, where a user\u0027s controller is vulnerable to template injection",
  "description": "A flaw was found in Ansible, where a user\u0027s controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.",
  "published": "2021-09-22T05:15:00Z",
  "severity": "Medium",
  "epss": 0.00897,
  "epssPercentile": 0.59794,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "ansible",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2.5.1\u002Bdfsg-1ubuntu0.1\u002Besm1",
      "fix": "ansible 2.5.1\u002Bdfsg-1ubuntu0.1\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ansible-2.5.1-dfsg-1ubuntu0.1-esm1",
      "released": "2021-09-22T05:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ansible",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2.9.6\u002Bdfsg-1ubuntu0.1~esm1",
      "fix": "ansible 2.9.6\u002Bdfsg-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ansible-2.9.6-dfsg-1ubuntu0.1-esm1",
      "released": "2022-03-03T11:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ansible",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.10.7\u002Bmerged\u002Bbase\u002B2.10.8\u002Bdfsg-1ubuntu0.1~esm1",
      "fix": "ansible 2.10.7\u002Bmerged\u002Bbase\u002B2.10.8\u002Bdfsg-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ansible-2.10.7-merged-base-2.10.8-dfsg-1ubuntu0.1-esm1",
      "released": "2022-03-03T11:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}