Action not permitted
Modal body text goes here.
CVE-2020-14365
Vulnerability from cvelistv5
Published
2020-09-23 12:25
Modified
2024-08-04 12:46
Severity
Summary
A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.
References
| Source | URL | Tags |
|---|---|---|
| secalert@redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=1869154 | Issue Tracking, Vendor Advisory |
| secalert@redhat.com | https://www.debian.org/security/2021/dsa-4950 | Third Party Advisory |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T12:46:33.762Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"name": "DSA-4950",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "https://www.debian.org/security/2021/dsa-4950"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "ansible",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "ansible-engine 2.8.15, ansible-engine 2.9.13"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-347",
"description": "CWE-347",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-08-07T14:06:19",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"name": "DSA-4950",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "https://www.debian.org/security/2021/dsa-4950"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2020-14365",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ansible",
"version": {
"version_data": [
{
"version_value": "ansible-engine 2.8.15, ansible-engine 2.9.13"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-347"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"name": "DSA-4950",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2021/dsa-4950"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2020-14365",
"datePublished": "2020-09-23T12:25:47",
"dateReserved": "2020-06-17T00:00:00",
"dateUpdated": "2024-08-04T12:46:33.762Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2020-14365\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2020-09-23T13:15:15.470\",\"lastModified\":\"2022-04-05T15:29:36.270\",\"vulnStatus\":\"Analyzed\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.\"},{\"lang\":\"es\",\"value\":\"Se encontr\u00f3 un fallo en Ansible Engine, en ansible-engine versiones 2.8.x anteriores a 2.8.15 y ansible-engine versiones 2.9.x anteriores a 2.9.13, Cuando se instalan paquetes usando el m\u00f3dulo dnf.\u0026#xa0;Unas firmas GPG son ignoradas durante la instalaci\u00f3n incluso cuando disable_gpg_check es establecida en False, que es el comportamiento predeterminado.\u0026#xa0;Este fallo conlleva a que son instalados paquetes maliciosos en el sistema y son ejecutados c\u00f3digos arbitrarios por medio de scripts de instalaci\u00f3n de paquetes.\u0026#xa0;La mayor amenaza de esta vulnerabilidad es la integridad y la disponibilidad del sistema\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:N/I:C/A:C\",\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\",\"baseScore\":6.6},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":9.2,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-347\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-347\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.8.0\",\"versionEndIncluding\":\"2.8.15\",\"matchCriteriaId\":\"128A8518-1B23-4263-8958-2A3813E70EAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.9.0\",\"versionEndIncluding\":\"2.9.13\",\"matchCriteriaId\":\"2633DB82-E043-4132-9493-B4CBB25FAE82\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.6.0\",\"versionEndIncluding\":\"3.6.5\",\"matchCriteriaId\":\"8EA99A5E-25E4-42A8-92D3-017734DA0AA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.7.0\",\"versionEndIncluding\":\"3.7.2\",\"matchCriteriaId\":\"DDE01259-A945-4567-AB95-8DAB087A686A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B31C575C-06D2-4CAF-A5B7-B9469B3ED55F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ceph_storage:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D07DF15E-FE6B-4DAF-99BB-2147CF7D7EEA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"516F4E8E-ED2F-4282-9DAB-D8B378F61258\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack_platform:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"542B31BD-5767-4B33-9201-40548D1223B3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C52600BF-9E87-4CD2-91F3-685AFE478C1E\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"07B237A9-69A3-4A9C-9DA0-4E06BD37AE73\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=1869154\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Vendor Advisory\"]},{\"url\":\"https://www.debian.org/security/2021/dsa-4950\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]}]}}"
}
}
rhsa-2020_3600
Vulnerability from csaf_redhat
Published
2020-09-01 19:32
Modified
2024-09-13 22:07
Summary
Red Hat Security Advisory: Ansible security and bug fix update (2.8.15)
Notes
Topic
An update for ansible is now available for Ansible Engine 2.8
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node
deployment, and remote-task execution system. Ansible works over SSH and
does not require any software or daemons to be installed on remote nodes.
Extension modules can be written in any language and are transferred to
managed machines automatically.
The following packages have been upgraded to a newer upstream version:
ansible (2.8.15)
Bug Fix(es):
* CVE-2020-14365 ansible: dnf module install packages with no GPG signature
See:
https://github.com/ansible/ansible/blob/v2.8.15/changelogs/CHANGELOG-v2.8.rst
for details on bug fixes in this release.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ansible is now available for Ansible Engine 2.8\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ansible is a simple model-driven configuration management, multi-node\ndeployment, and remote-task execution system. Ansible works over SSH and\ndoes not require any software or daemons to be installed on remote nodes.\nExtension modules can be written in any language and are transferred to\nmanaged machines automatically.\n\nThe following packages have been upgraded to a newer upstream version:\nansible (2.8.15)\n\nBug Fix(es):\n* CVE-2020-14365 ansible: dnf module install packages with no GPG signature\n\nSee:\nhttps://github.com/ansible/ansible/blob/v2.8.15/changelogs/CHANGELOG-v2.8.rst\nfor details on bug fixes in this release.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:3600",
"url": "https://access.redhat.com/errata/RHSA-2020:3600"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1869154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2020/rhsa-2020_3600.json"
}
],
"title": "Red Hat Security Advisory: Ansible security and bug fix update (2.8.15)",
"tracking": {
"current_release_date": "2024-09-13T22:07:49+00:00",
"generator": {
"date": "2024-09-13T22:07:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2020:3600",
"initial_release_date": "2020-09-01T19:32:43+00:00",
"revision_history": [
{
"date": "2020-09-01T19:32:43+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-09-01T19:32:43+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-13T22:07:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2.8 for RHEL 7 Server",
"product": {
"name": "Red Hat Ansible Engine 2.8 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.8",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2.8::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2.8 for RHEL 8",
"product": {
"name": "Red Hat Ansible Engine 2.8 for RHEL 8",
"product_id": "8Base-Ansible-2.8",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2.8::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Engine"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.8.15-1.el7ae.noarch",
"product": {
"name": "ansible-0:2.8.15-1.el7ae.noarch",
"product_id": "ansible-0:2.8.15-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.8.15-1.el7ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.8.15-1.el8ae.noarch",
"product": {
"name": "ansible-0:2.8.15-1.el8ae.noarch",
"product_id": "ansible-0:2.8.15-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.8.15-1.el8ae?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.8.15-1.el7ae.src",
"product": {
"name": "ansible-0:2.8.15-1.el7ae.src",
"product_id": "ansible-0:2.8.15-1.el7ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.8.15-1.el7ae?arch=src"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.8.15-1.el8ae.src",
"product": {
"name": "ansible-0:2.8.15-1.el8ae.src",
"product_id": "ansible-0:2.8.15-1.el8ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.8.15-1.el8ae?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.8.15-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.8 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch"
},
"product_reference": "ansible-0:2.8.15-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.8.15-1.el7ae.src as a component of Red Hat Ansible Engine 2.8 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src"
},
"product_reference": "ansible-0:2.8.15-1.el7ae.src",
"relates_to_product_reference": "7Server-Ansible-2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.8.15-1.el8ae.noarch as a component of Red Hat Ansible Engine 2.8 for RHEL 8",
"product_id": "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch"
},
"product_reference": "ansible-0:2.8.15-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2.8"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.8.15-1.el8ae.src as a component of Red Hat Ansible Engine 2.8 for RHEL 8",
"product_id": "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
},
"product_reference": "ansible-0:2.8.15-1.el8ae.src",
"relates_to_product_reference": "8Base-Ansible-2.8"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-1736",
"cwe": {
"id": "CWE-732",
"name": "Incorrect Permission Assignment for Critical Resource"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1802124"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This issue affects only the newly created files and not existing ones. If the file already exists at the final destination, those permissions are retained. This could lead to the disclosure of sensitive data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: atomic_move primitive sets permissive permissions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.8.14 and 2.9.12 as well as previous versions and all 2.7.x versions are affected.\n\nAnsible Tower 3.6.5 and 3.7.2 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1736"
},
{
"category": "external",
"summary": "RHBZ#1802124",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802124"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1736",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1736"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1736",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1736"
}
],
"release_date": "2020-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3600"
},
{
"category": "workaround",
"details": "This issue can be mitigated by specifying the \"mode\" on the task. That just leaves a race condition in place where newly created files that specify a mode in the task briefly go from 666 - umask to the final mode. An alternative workaround if many new files are created and to avoid setting a specific mode for each file would be to set the \"mode\" to \"preserve\" value. That will maintain the permissions of the source file on the controller in the final file on the managed host.",
"product_ids": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 2.2,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ansible: atomic_move primitive sets permissive permissions"
},
{
"acknowledgments": [
{
"names": [
"Hung Luong"
]
}
],
"cve": "CVE-2020-14330",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"discovery_date": "2020-07-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1856815"
}
],
"notes": [
{
"category": "description",
"text": "An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: masked keys for uri module are exposed into content and json output",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Ansible Engine 2.9.12 (downstream) and Ansible Engine 2.9.11 (upstream), as well as previous versions are affected by this flaw. Ansible Engine 2.9.12 version (upstream) on towards fixes the issue for upstream and Red Hat Ansible Engine 2.9.13 version is fixed (downstream).\n\nRed Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of Ansible, but they no longer maintain their own version of Ansible. Both the products will consume fixes directly from the Ansible repository. As we still ship Ansible separately for Ceph on Ubuntu, a future update may address this issue.\n\nIn Red Hat OpenStack Platform, because ansible is not directly customer exposed (so that the flaw could not be exploited) and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package. Note: Red Hat Open Stack Platform 15 and newer consume fixes directly from the Ansible repository.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14330"
},
{
"category": "external",
"summary": "RHBZ#1856815",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856815"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14330",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14330"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14330",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14330"
},
{
"category": "external",
"summary": "https://github.com/ansible/ansible/issues/68400",
"url": "https://github.com/ansible/ansible/issues/68400"
}
],
"release_date": "2020-03-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3600"
},
{
"category": "workaround",
"details": "There is no mitigation for this issue.",
"product_ids": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Ansible: masked keys for uri module are exposed into content and json output"
},
{
"cve": "CVE-2020-14332",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"discovery_date": "2020-07-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1857805"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: module_args does not censor properly in --check mode",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The version of ansible provided in Red Hat Gluster Storage 3, Red Hat Ceph Storage 2 and 3 does not contain the vulnerable functionality and is not affected by this vulnerability. Additionally, these storage products no longer maintains their own version of ansible and fixes are consumed from core Ansible repository.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14332"
},
{
"category": "external",
"summary": "RHBZ#1857805",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857805"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14332",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14332"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14332",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14332"
},
{
"category": "external",
"summary": "https://github.com/ansible/ansible/pull/71033",
"url": "https://github.com/ansible/ansible/pull/71033"
}
],
"release_date": "2020-07-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3600"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Ansible: module_args does not censor properly in --check mode"
},
{
"acknowledgments": [
{
"names": [
"Bruno Travouillon"
],
"organization": "Atos"
}
],
"cve": "CVE-2020-14365",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2020-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1869154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Ansible Engine when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: dnf module install packages with no GPG signature",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.8.14 and 2.9.12 as well as previous versions versions are affected.\n\nAnsible Tower 3.7.2 and 3.6.5 as well as previous versions are affected for containerized versions and has been fixed indirectly in the 3.6.6 and 3.7.3 releases. For non-containerized Ansible Tower versions, the fix is provided via yum update or yum install.\n\nRed Hat Gluster Storage(RHGS) 3, Red Hat Ceph Storage (RHCS) 2 and 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository. As RHCS 2 and 3 do not use dnf, impact rating is reduced to Low. RHCS still ship ansible separately for Ceph on Ubuntu, but Ubuntu is not impacted by this vulnerability as it uses apt instead of dnf.\n\nRed Hat OpenStack Platform 10 and 13 ship a vulnerable version of Ansible, however installation of packages is done via yum instead of dnf so this flaw will have no effect.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14365"
},
{
"category": "external",
"summary": "RHBZ#1869154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14365",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14365"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14365",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14365"
}
],
"release_date": "2020-08-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3600"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.",
"product_ids": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
"7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
"8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ansible: dnf module install packages with no GPG signature"
}
]
}
rhsa-2020_3602
Vulnerability from csaf_redhat
Published
2020-09-01 19:33
Modified
2024-09-13 22:08
Summary
Red Hat Security Advisory: Ansible security and bug fix update (2.9.13)
Notes
Topic
An update for ansible is now available for Ansible Engine 2
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node
deployment, and remote-task execution system. Ansible works over SSH and
does not require any software or daemons to be installed on remote nodes.
Extension modules can be written in any language and are transferred to
managed machines automatically.
The following packages have been upgraded to a newer upstream version:
ansible (2.9.13)
Bug Fix(es):
* CVE-2020-14365 ansible: dnf module install packages with no GPG signature
See:
https://github.com/ansible/ansible/blob/v2.9.13/changelogs/CHANGELOG-v2.9.rst
for details on bug fixes in this release.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ansible is now available for Ansible Engine 2\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ansible is a simple model-driven configuration management, multi-node\ndeployment, and remote-task execution system. Ansible works over SSH and\ndoes not require any software or daemons to be installed on remote nodes.\nExtension modules can be written in any language and are transferred to\nmanaged machines automatically.\n\nThe following packages have been upgraded to a newer upstream version:\nansible (2.9.13)\n\nBug Fix(es):\n* CVE-2020-14365 ansible: dnf module install packages with no GPG signature\n\nSee:\nhttps://github.com/ansible/ansible/blob/v2.9.13/changelogs/CHANGELOG-v2.9.rst\nfor details on bug fixes in this release.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:3602",
"url": "https://access.redhat.com/errata/RHSA-2020:3602"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1869154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2020/rhsa-2020_3602.json"
}
],
"title": "Red Hat Security Advisory: Ansible security and bug fix update (2.9.13)",
"tracking": {
"current_release_date": "2024-09-13T22:08:04+00:00",
"generator": {
"date": "2024-09-13T22:08:04+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2020:3602",
"initial_release_date": "2020-09-01T19:33:01+00:00",
"revision_history": [
{
"date": "2020-09-01T19:33:01+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-09-01T19:33:01+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-13T22:08:04+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2 for RHEL 7",
"product": {
"name": "Red Hat Ansible Engine 2 for RHEL 7",
"product_id": "7Server-Ansible-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2 for RHEL 8",
"product": {
"name": "Red Hat Ansible Engine 2 for RHEL 8",
"product_id": "8Base-Ansible-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Engine"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.13-1.el7ae.noarch",
"product": {
"name": "ansible-0:2.9.13-1.el7ae.noarch",
"product_id": "ansible-0:2.9.13-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.13-1.el7ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.9.13-1.el7ae.noarch",
"product": {
"name": "ansible-test-0:2.9.13-1.el7ae.noarch",
"product_id": "ansible-test-0:2.9.13-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.9.13-1.el7ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.9.13-1.el8ae.noarch",
"product": {
"name": "ansible-0:2.9.13-1.el8ae.noarch",
"product_id": "ansible-0:2.9.13-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.13-1.el8ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.9.13-1.el8ae.noarch",
"product": {
"name": "ansible-test-0:2.9.13-1.el8ae.noarch",
"product_id": "ansible-test-0:2.9.13-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.9.13-1.el8ae?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.13-1.el7ae.src",
"product": {
"name": "ansible-0:2.9.13-1.el7ae.src",
"product_id": "ansible-0:2.9.13-1.el7ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.13-1.el7ae?arch=src"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.9.13-1.el8ae.src",
"product": {
"name": "ansible-0:2.9.13-1.el8ae.src",
"product_id": "ansible-0:2.9.13-1.el8ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.13-1.el8ae?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.13-1.el7ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7",
"product_id": "7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.noarch"
},
"product_reference": "ansible-0:2.9.13-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.13-1.el7ae.src as a component of Red Hat Ansible Engine 2 for RHEL 7",
"product_id": "7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.src"
},
"product_reference": "ansible-0:2.9.13-1.el7ae.src",
"relates_to_product_reference": "7Server-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.9.13-1.el7ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7",
"product_id": "7Server-Ansible-2:ansible-test-0:2.9.13-1.el7ae.noarch"
},
"product_reference": "ansible-test-0:2.9.13-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.13-1.el8ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 8",
"product_id": "8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.noarch"
},
"product_reference": "ansible-0:2.9.13-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.13-1.el8ae.src as a component of Red Hat Ansible Engine 2 for RHEL 8",
"product_id": "8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.src"
},
"product_reference": "ansible-0:2.9.13-1.el8ae.src",
"relates_to_product_reference": "8Base-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.9.13-1.el8ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 8",
"product_id": "8Base-Ansible-2:ansible-test-0:2.9.13-1.el8ae.noarch"
},
"product_reference": "ansible-test-0:2.9.13-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Bruno Travouillon"
],
"organization": "Atos"
}
],
"cve": "CVE-2020-14365",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2020-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1869154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Ansible Engine when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: dnf module install packages with no GPG signature",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.8.14 and 2.9.12 as well as previous versions versions are affected.\n\nAnsible Tower 3.7.2 and 3.6.5 as well as previous versions are affected for containerized versions and has been fixed indirectly in the 3.6.6 and 3.7.3 releases. For non-containerized Ansible Tower versions, the fix is provided via yum update or yum install.\n\nRed Hat Gluster Storage(RHGS) 3, Red Hat Ceph Storage (RHCS) 2 and 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository. As RHCS 2 and 3 do not use dnf, impact rating is reduced to Low. RHCS still ship ansible separately for Ceph on Ubuntu, but Ubuntu is not impacted by this vulnerability as it uses apt instead of dnf.\n\nRed Hat OpenStack Platform 10 and 13 ship a vulnerable version of Ansible, however installation of packages is done via yum instead of dnf so this flaw will have no effect.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.13-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.13-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14365"
},
{
"category": "external",
"summary": "RHBZ#1869154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14365",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14365"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14365",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14365"
}
],
"release_date": "2020-08-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.13-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.13-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3602"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.13-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.13-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.13-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.13-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ansible: dnf module install packages with no GPG signature"
}
]
}
rhsa-2020_3601
Vulnerability from csaf_redhat
Published
2020-09-01 19:32
Modified
2024-09-13 22:07
Summary
Red Hat Security Advisory: Ansible security and bug fix update (2.9.13)
Notes
Topic
An update for ansible is now available for Ansible Engine 2.9
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node
deployment, and remote-task execution system. Ansible works over SSH and
does not require any software or daemons to be installed on remote nodes.
Extension modules can be written in any language and are transferred to
managed machines automatically.
The following packages have been upgraded to a newer upstream version:
ansible (2.9.13)
Bug Fix(es):
* CVE-2020-14365 ansible: dnf module install packages with no GPG signature
See:
https://github.com/ansible/ansible/blob/v2.9.13/changelogs/CHANGELOG-v2.9.rst
for details on bug fixes in this release.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_vex",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ansible is now available for Ansible Engine 2.9\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ansible is a simple model-driven configuration management, multi-node\ndeployment, and remote-task execution system. Ansible works over SSH and\ndoes not require any software or daemons to be installed on remote nodes.\nExtension modules can be written in any language and are transferred to\nmanaged machines automatically.\n\nThe following packages have been upgraded to a newer upstream version:\nansible (2.9.13)\n\nBug Fix(es):\n* CVE-2020-14365 ansible: dnf module install packages with no GPG signature\n\nSee:\nhttps://github.com/ansible/ansible/blob/v2.9.13/changelogs/CHANGELOG-v2.9.rst\nfor details on bug fixes in this release.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:3601",
"url": "https://access.redhat.com/errata/RHSA-2020:3601"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1869154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/data/csaf/v2/advisories/2020/rhsa-2020_3601.json"
}
],
"title": "Red Hat Security Advisory: Ansible security and bug fix update (2.9.13)",
"tracking": {
"current_release_date": "2024-09-13T22:07:56+00:00",
"generator": {
"date": "2024-09-13T22:07:56+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "3.33.3"
}
},
"id": "RHSA-2020:3601",
"initial_release_date": "2020-09-01T19:32:52+00:00",
"revision_history": [
{
"date": "2020-09-01T19:32:52+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-09-01T19:32:52+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-09-13T22:07:56+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2.9 for RHEL 8",
"product": {
"name": "Red Hat Ansible Engine 2.9 for RHEL 8",
"product_id": "8Base-Ansible-2.9",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2.9::el8"
}
}
},
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product": {
"name": "Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.9",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2.9::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Engine"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.13-1.el8ae.noarch",
"product": {
"name": "ansible-0:2.9.13-1.el8ae.noarch",
"product_id": "ansible-0:2.9.13-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.13-1.el8ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.9.13-1.el8ae.noarch",
"product": {
"name": "ansible-test-0:2.9.13-1.el8ae.noarch",
"product_id": "ansible-test-0:2.9.13-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.9.13-1.el8ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.9.13-1.el7ae.noarch",
"product": {
"name": "ansible-0:2.9.13-1.el7ae.noarch",
"product_id": "ansible-0:2.9.13-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.13-1.el7ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.9.13-1.el7ae.noarch",
"product": {
"name": "ansible-test-0:2.9.13-1.el7ae.noarch",
"product_id": "ansible-test-0:2.9.13-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.9.13-1.el7ae?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.13-1.el8ae.src",
"product": {
"name": "ansible-0:2.9.13-1.el8ae.src",
"product_id": "ansible-0:2.9.13-1.el8ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.13-1.el8ae?arch=src"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.9.13-1.el7ae.src",
"product": {
"name": "ansible-0:2.9.13-1.el7ae.src",
"product_id": "ansible-0:2.9.13-1.el7ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.13-1.el7ae?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.13-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.9:ansible-0:2.9.13-1.el7ae.noarch"
},
"product_reference": "ansible-0:2.9.13-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.13-1.el7ae.src as a component of Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.9:ansible-0:2.9.13-1.el7ae.src"
},
"product_reference": "ansible-0:2.9.13-1.el7ae.src",
"relates_to_product_reference": "7Server-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.9.13-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.9:ansible-test-0:2.9.13-1.el7ae.noarch"
},
"product_reference": "ansible-test-0:2.9.13-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.13-1.el8ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 8",
"product_id": "8Base-Ansible-2.9:ansible-0:2.9.13-1.el8ae.noarch"
},
"product_reference": "ansible-0:2.9.13-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.13-1.el8ae.src as a component of Red Hat Ansible Engine 2.9 for RHEL 8",
"product_id": "8Base-Ansible-2.9:ansible-0:2.9.13-1.el8ae.src"
},
"product_reference": "ansible-0:2.9.13-1.el8ae.src",
"relates_to_product_reference": "8Base-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.9.13-1.el8ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 8",
"product_id": "8Base-Ansible-2.9:ansible-test-0:2.9.13-1.el8ae.noarch"
},
"product_reference": "ansible-test-0:2.9.13-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2.9"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Bruno Travouillon"
],
"organization": "Atos"
}
],
"cve": "CVE-2020-14365",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2020-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1869154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Ansible Engine when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: dnf module install packages with no GPG signature",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.8.14 and 2.9.12 as well as previous versions versions are affected.\n\nAnsible Tower 3.7.2 and 3.6.5 as well as previous versions are affected for containerized versions and has been fixed indirectly in the 3.6.6 and 3.7.3 releases. For non-containerized Ansible Tower versions, the fix is provided via yum update or yum install.\n\nRed Hat Gluster Storage(RHGS) 3, Red Hat Ceph Storage (RHCS) 2 and 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository. As RHCS 2 and 3 do not use dnf, impact rating is reduced to Low. RHCS still ship ansible separately for Ceph on Ubuntu, but Ubuntu is not impacted by this vulnerability as it uses apt instead of dnf.\n\nRed Hat OpenStack Platform 10 and 13 ship a vulnerable version of Ansible, however installation of packages is done via yum instead of dnf so this flaw will have no effect.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.9:ansible-0:2.9.13-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.13-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.13-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.13-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.13-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.13-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-14365"
},
{
"category": "external",
"summary": "RHBZ#1869154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-14365",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-14365"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14365",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14365"
}
],
"release_date": "2020-08-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.13-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.13-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.13-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.13-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.13-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.13-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:3601"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.13-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.13-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.13-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.13-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.13-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.13-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.9:ansible-0:2.9.13-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.13-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.13-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.13-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.13-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.13-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "ansible: dnf module install packages with no GPG signature"
}
]
}
wid-sec-w-2023-2469
Vulnerability from csaf_certbund
Published
2020-09-01 22:00
Modified
2024-05-06 22:00
Summary
Ansible: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Ansible ist eine Software zur Automatisierung von Cloud Provisionierung,
zum Konfigurationsmanagement und zur Anwendungsbereitstellung.
Angriff
Ein lokaler Angreifer kann eine Schwachstelle in Ansible und Ansible Tower ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
Betroffene Betriebssysteme
- Linux
- MacOS X
- UNIX
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Ansible ist eine Software zur Automatisierung von Cloud Provisionierung,\r\nzum Konfigurationsmanagement und zur Anwendungsbereitstellung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein lokaler Angreifer kann eine Schwachstelle in Ansible und Ansible Tower ausnutzen, um Sicherheitsvorkehrungen zu umgehen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux\n- MacOS X\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-2469 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2023-2469.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-2469 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2469"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2020:3600 vom 2020-09-01",
"url": "https://access.redhat.com/errata/RHSA-2020:3600"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2020:3601 vom 2020-09-01",
"url": "https://access.redhat.com/errata/RHSA-2020:3601"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2020:3602 vom 2020-09-01",
"url": "https://access.redhat.com/errata/RHSA-2020:3602"
},
{
"category": "external",
"summary": "Ansible Changelog 2.8.15 vom 2020-09-01",
"url": "https://github.com/ansible/ansible/blob/v2.8.15/changelogs/CHANGELOG-v2.8.rst#security-fixes"
},
{
"category": "external",
"summary": "Ansible Changelog 2.9.13 vom 2020-09-01",
"url": "https://github.com/ansible/ansible/blob/v2.9.13/changelogs/CHANGELOG-v2.9.rst#security-fixes"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2020:4137 vom 2020-09-30",
"url": "https://access.redhat.com/errata/RHSA-2020:4137"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2020:4136 vom 2020-09-30",
"url": "https://access.redhat.com/errata/RHSA-2020:4136"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2020:4201 vom 2020-10-07",
"url": "https://access.redhat.com/errata/RHSA-2020:4201"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2020:3309-1 vom 2020-11-12",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2020-November/007763.html"
},
{
"category": "external",
"summary": "Debian Security Advisory DSA-4950 vom 2021-08-07",
"url": "https://www.debian.org/security/2021/dsa-4950"
},
{
"category": "external",
"summary": "Amazon Linux Security Advisory ALASANSIBLE2-2023-005 vom 2023-09-27",
"url": "https://alas.aws.amazon.com/AL2/ALASANSIBLE2-2023-005.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1427-1 vom 2024-04-24",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-April/018418.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2024:1509-1 vom 2024-05-06",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2024-May/018463.html"
}
],
"source_lang": "en-US",
"title": "Ansible: Schwachstelle erm\u00f6glicht Umgehen von Sicherheitsvorkehrungen",
"tracking": {
"current_release_date": "2024-05-06T22:00:00.000+00:00",
"generator": {
"date": "2024-05-07T08:34:50.718+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.0"
}
},
"id": "WID-SEC-W-2023-2469",
"initial_release_date": "2020-09-01T22:00:00.000+00:00",
"revision_history": [
{
"date": "2020-09-01T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2020-09-30T22:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2020-10-06T22:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von Red Hat aufgenommen"
},
{
"date": "2020-11-12T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2021-08-08T22:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von Debian aufgenommen"
},
{
"date": "2023-09-27T22:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von Amazon aufgenommen"
},
{
"date": "2024-04-24T22:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2024-05-06T22:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von SUSE aufgenommen"
}
],
"status": "final",
"version": "8"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Amazon Linux 2",
"product": {
"name": "Amazon Linux 2",
"product_id": "398363",
"product_identification_helper": {
"cpe": "cpe:/o:amazon:linux_2:-"
}
}
}
],
"category": "vendor",
"name": "Amazon"
},
{
"branches": [
{
"category": "product_name",
"name": "Debian Linux",
"product": {
"name": "Debian Linux",
"product_id": "2951",
"product_identification_helper": {
"cpe": "cpe:/o:debian:debian_linux:-"
}
}
}
],
"category": "vendor",
"name": "Debian"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c2.9.13",
"product": {
"name": "Open Source Ansible \u003c2.9.13",
"product_id": "T017191",
"product_identification_helper": {
"cpe": "cpe:/a:open_source:ansible:2.9.13"
}
}
},
{
"category": "product_version_range",
"name": "\u003c2.8.15",
"product": {
"name": "Open Source Ansible \u003c2.8.15",
"product_id": "T017192",
"product_identification_helper": {
"cpe": "cpe:/a:open_source:ansible:2.8.15"
}
}
}
],
"category": "product_name",
"name": "Ansible"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c=3.7.2",
"product": {
"name": "Open Source Ansible Tower \u003c=3.7.2",
"product_id": "T017017",
"product_identification_helper": {
"cpe": "cpe:/a:open_source:ansible_tower:3.7.2"
}
}
},
{
"category": "product_version_range",
"name": "\u003c=3.6.5",
"product": {
"name": "Open Source Ansible Tower \u003c=3.6.5",
"product_id": "T017050",
"product_identification_helper": {
"cpe": "cpe:/a:open_source:ansible_tower:3.6.5"
}
}
}
],
"category": "product_name",
"name": "Ansible Tower"
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "T015361",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2020-14365",
"notes": [
{
"category": "description",
"text": "Es existiert eine Schwachstelle in der Ansible Engine und Ansible Tower. Sie beruht darauf, dass GPG Signaturen nicht beachtet werden, wenn Pakete mit dem \"dnf\" Modul installiert werden und \"disable_gpg_check\" auf \"FALSE\" gesetzt ist (Standardeinstellung). Ein Angreifer kann dieses nutzen und Sicherheitsmechanismen umgehen und so beliebige Pakete installieren."
}
],
"product_status": {
"known_affected": [
"T015361",
"2951",
"T002207",
"398363"
],
"last_affected": [
"T017017",
"T017050"
]
},
"release_date": "2020-09-01T22:00:00Z",
"title": "CVE-2020-14365"
}
]
}
ghsa-m429-fhmv-c6q2
Vulnerability from github
Published
2021-04-20 16:44
Modified
2024-09-06 20:08
Severity
7.1 (High) - CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
6.9 (Medium) - CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
6.9 (Medium) - CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Summary
Improper Verification of Cryptographic Signature in ansible
Details
A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0a1"
},
{
"fixed": "2.8.15"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"events": [
{
"introduced": "2.9.0a1"
},
{
"fixed": "2.9.13"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-14365"
],
"database_specific": {
"cwe_ids": [
"CWE-347"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-02T22:49:57Z",
"nvd_published_at": "2020-09-23T13:15:00Z",
"severity": "HIGH"
},
"details": "A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when `disable_gpg_check` is set to `False`, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.",
"id": "GHSA-m429-fhmv-c6q2",
"modified": "2024-09-06T20:08:44Z",
"published": "2021-04-20T16:44:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14365"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/1d043e082b3b1f3ad35c803137f5d3bcbae92275"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/1fa2d5fd6b768120b76a77929e27302b06accc0c"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/9bea33ffa3be3d64827f59882d95b817cfab9b7e"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-m429-fhmv-c6q2"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-209.yaml"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4950"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Improper Verification of Cryptographic Signature in ansible"
}
pysec-2020-209
Vulnerability from pysec
Published
2020-09-23 13:15
Modified
2021-07-02 02:41
Details
A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible",
"purl": "pkg:pypi/ansible"
},
"ranges": [
{
"events": [
{
"introduced": "2.8.0"
},
{
"fixed": "2.8.16rc1"
},
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.14rc1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.8.0",
"2.8.1",
"2.8.10",
"2.8.11",
"2.8.12",
"2.8.13",
"2.8.14",
"2.8.15",
"2.8.2",
"2.8.3",
"2.8.4",
"2.8.5",
"2.8.6",
"2.8.7",
"2.8.8",
"2.8.9",
"2.9.0",
"2.9.1",
"2.9.10",
"2.9.11",
"2.9.12",
"2.9.13",
"2.9.2",
"2.9.3",
"2.9.4",
"2.9.5",
"2.9.6",
"2.9.7",
"2.9.8",
"2.9.9"
]
}
],
"aliases": [
"CVE-2020-14365",
"GHSA-m429-fhmv-c6q2"
],
"details": "A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.",
"id": "PYSEC-2020-209",
"modified": "2021-07-02T02:41:35.012028Z",
"published": "2020-09-23T13:15:00Z",
"references": [
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-m429-fhmv-c6q2"
}
]
}
gsd-2020-14365
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-14365",
"description": "A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.",
"id": "GSD-2020-14365",
"references": [
"https://www.suse.com/security/cve/CVE-2020-14365.html",
"https://www.debian.org/security/2021/dsa-4950",
"https://access.redhat.com/errata/RHSA-2020:3602",
"https://access.redhat.com/errata/RHSA-2020:3601",
"https://access.redhat.com/errata/RHSA-2020:3600",
"https://advisories.mageia.org/CVE-2020-14365.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-14365"
],
"details": "A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.",
"id": "GSD-2020-14365",
"modified": "2023-12-13T01:21:59.987067Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2020-14365",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "ansible",
"version": {
"version_data": [
{
"version_value": "ansible-engine 2.8.15, ansible-engine 2.9.13"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-347"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154",
"refsource": "MISC",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"name": "DSA-4950",
"refsource": "DEBIAN",
"url": "https://www.debian.org/security/2021/dsa-4950"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003e=2.8.0,\u003c=2.8.15||\u003e=2.9.0,\u003c=2.9.13",
"affected_versions": "All versions starting from 2.8.0 up to 2.8.15, all versions starting from 2.9.0 up to 2.9.13",
"cvss_v2": "AV:L/AC:L/Au:N/C:N/I:C/A:C",
"cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"cwe_ids": [
"CWE-1035",
"CWE-347",
"CWE-937"
],
"date": "2021-08-07",
"description": "A flaw was found in the Ansible Engine when installing packages using the dnf module. GPG signatures are ignored during installation even when `disable_gpg_check` is set to `False`, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.",
"fixed_versions": [
"2.8.16",
"2.9.14"
],
"identifier": "CVE-2020-14365",
"identifiers": [
"CVE-2020-14365"
],
"not_impacted": "All versions before 2.8.0, all versions after 2.8.15 before 2.9.0, all versions after 2.9.13",
"package_slug": "pypi/ansible",
"pubdate": "2020-09-23",
"solution": "Upgrade to versions 2.8.16, 2.9.14 or above.",
"title": "Improper Verification of Cryptographic Signature",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-14365",
"https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
],
"uuid": "5738848d-2299-44d3-9b5d-f633cf69a8ff"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.8.15",
"versionStartIncluding": "2.8.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "2.9.13",
"versionStartIncluding": "2.9.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.6.5",
"versionStartIncluding": "3.6.0",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.7.2",
"versionStartIncluding": "3.7.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:ceph_storage:2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack_platform:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2020-14365"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-347"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154",
"refsource": "MISC",
"tags": [
"Issue Tracking",
"Vendor Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
},
{
"name": "DSA-4950",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "https://www.debian.org/security/2021/dsa-4950"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 6.6,
"confidentialityImpact": "NONE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 9.2,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2
}
},
"lastModifiedDate": "2022-04-05T15:29Z",
"publishedDate": "2020-09-23T13:15Z"
}
}
}
Loading...