Red Hat Ansible
At a glance
- Source
- NVD
- EPSS
- EPSS 0.36 % · percentile 30 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.
Weaknesses (CWE)
- CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739
- https://github.com/ansible/ansible/issues/67797
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/
- https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html
- https://www.debian.org/security/2021/dsa-4950
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | LOW 3.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | redhat |
| CVSS 3.1 | LOW 3.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | NVD · secalert@redhat.com (Secondary) |
| CVSS 3.1 | LOW 3.9 | CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 3.3 | AV:L/AC:M/Au:N/C:P/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-923p-fr2c-g5m2 — Exposure of Sensitive Information to an Unauthorized Actor in Ansible
- PYSEC-2020-11 — A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used
European references
- ENISA EUVD · EUVD-2020-0004
- GCVE · GCVE-0-2020-1739
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≤ 2.7.16cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≥ 2.8.0 ≤ 2.8.8cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*≥ 2.9.0 ≤ 2.9.5cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*≤ 3.3.4cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*≥ 3.4.0 ≤ 3.4.5cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*≥ 3.5.0 ≤ 3.5.5cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*≥ 3.6.0 ≤ 3.6.3cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Red Hat · Ansible | affected 2.7.16 and prior ; affected 2.8.8 and prior ; affected 2.9.5 and prior |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |