7.9
High
CVE-2020-10684 A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively,…
Description
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ansible | Versions not published |
References
- FEDORA-2020-1b6ce91e37 lists.fedoraproject.org
- FEDORA-2020-3990f03ba3 lists.fedoraproject.org
- FEDORA-2020-f80154b5b4 lists.fedoraproject.org
- GLSA-202006-11 security.gentoo.org
- DSA-4950 www.debian.org
- bugzilla.redhat.com bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Ansible
The 29 CVEs of Ansible →
CVE-2020-14332
A flaw was found in the Ansible Engine when using module_args
5.5
Medium
CVE-2020-14330
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data…
5.0
Medium
CVE-2020-10744
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running…
5.0
Medium
CVE-2020-1746
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and…
5.0
Medium