PYSEC-2020-6
At a glance
- Published
- Updated
- CVE
- CVE-2020-1734
- Aliases
- GHSA-h39q-95q5-9jfp
Description
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.
Affected packages
| Package | Versions |
|---|---|
| PyPI · ansible | introduced 0, fixed 2.7.17 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1734 REPORT
- https://github.com/ansible/ansible/issues/67792 REPORT
- https://github.com/advisories/GHSA-h39q-95q5-9jfp ADVISORY
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — PyPA Advisory Database |