Action not permitted
Modal body text goes here.
cve-2020-10691
Vulnerability from cvelistv5
Published
2020-04-30 16:23
Modified
2024-08-04 11:06
Severity ?
EPSS score ?
Summary
An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.
References
| ▼ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691 | Issue Tracking, Mitigation, Vendor Advisory | |
| secalert@redhat.com | https://github.com/ansible/ansible/pull/68596 | Patch, Third Party Advisory |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:06:11.130Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/ansible/ansible/pull/68596"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Ansible",
"vendor": "Red Hat",
"versions": [
{
"status": "affected",
"version": "all ansible-engine versions 2.9.x prior to 2.9.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-30T16:23:36",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/ansible/ansible/pull/68596"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2020-10691",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Ansible",
"version": {
"version_data": [
{
"version_value": "all ansible-engine versions 2.9.x prior to 2.9.7"
}
]
}
}
]
},
"vendor_name": "Red Hat"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "5.2/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691"
},
{
"name": "https://github.com/ansible/ansible/pull/68596",
"refsource": "CONFIRM",
"url": "https://github.com/ansible/ansible/pull/68596"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2020-10691",
"datePublished": "2020-04-30T16:23:36",
"dateReserved": "2020-03-20T00:00:00",
"dateUpdated": "2024-08-04T11:06:11.130Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2020-10691\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2020-04-30T17:15:11.957\",\"lastModified\":\"2023-11-07T03:14:13.183\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.\"},{\"lang\":\"es\",\"value\":\"Se ha detectado un fallo de salto de archivo en todas las versiones de ansible-engine 2.9.x anteriores a 2.9.7, cuando se ejecuta una instalaci\u00f3n de una colecci\u00f3n ansible-galaxy. Al extraer un archivo .tar.gz de la colecci\u00f3n, el directorio es creado sin sanear el nombre del archivo. Un atacante podr\u00eda aprovechar para sobrescribir cualquier archivo dentro del sistema.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\",\"baseScore\":5.2,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.0,\"impactScore\":2.7},{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\",\"baseScore\":5.2,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.0,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:N/I:P/A:P\",\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":3.6},\"baseSeverity\":\"LOW\",\"exploitabilityScore\":3.9,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]},{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.9.0\",\"versionEndExcluding\":\"2.9.7\",\"matchCriteriaId\":\"9CB17437-BAA5-41DF-B0EB-857441A81804\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B31C575C-06D2-4CAF-A5B7-B9469B3ED55F\"}]}]}],\"references\":[{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/ansible/ansible/pull/68596\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}"
}
}
ghsa-3c67-gc48-983w
Vulnerability from github
Published
2021-04-20 16:44
Modified
2024-09-04 20:57
Severity ?
5.2 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
4.8 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
4.8 (Medium) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Summary
Path Traversal in Ansible
Details
An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible"
},
"ranges": [
{
"events": [
{
"introduced": "2.9.0a1"
},
{
"fixed": "2.9.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2020-10691"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2021-04-05T14:22:26Z",
"nvd_published_at": "2020-04-30T17:15:00Z",
"severity": "MODERATE"
},
"details": "An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running `ansible-galaxy collection` install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.",
"id": "GHSA-3c67-gc48-983w",
"modified": "2024-09-04T20:57:28Z",
"published": "2021-04-20T16:44:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10691"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/pull/68596"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/commit/b2551bb6943eec078066aa3a923e0bb3ed85abe8"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-3c67-gc48-983w"
},
{
"type": "PACKAGE",
"url": "https://github.com/ansible/ansible"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-2.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Path Traversal in Ansible"
}
rhsa-2020_1541
Vulnerability from csaf_redhat
Published
2020-04-22 14:10
Modified
2024-11-05 22:06
Summary
Red Hat Security Advisory: Ansible security and bug fix update (2.9.7)
Notes
Topic
An update for ansible is now available for Ansible Engine 2.9
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node
deployment, and remote-task execution system. Ansible works over SSH and
does not require any software or daemons to be installed on remote nodes.
Extension modules can be written in any language and are transferred to
managed machines automatically.
The following packages have been upgraded to a newer upstream version:
ansible (2.9.7)
Bug Fix(es):
* CVE-2020-10684 Ansible: code injection when using ansible_facts as a
subkey
* CVE-2020-10685 Ansible: modules which use files encrypted with vault are
not properly cleaned up
* CVE-2020-10691 Ansible: archive traversal vulnerability in ansible-galaxy
collection install
* CVE-2020-1733 ansible: insecure temporary directory when running
become_user from become directive
* CVE-2020-1735 ansible: path injection on dest parameter in fetch module
* CVE-2020-1737 ansible: Extract-Zip function in win_unzip module does not
check extracted path
* CVE-2020-1739 ansible: svn module leaks password when specified as a
parameter
* CVE-2020-1740 ansible: secrets readable after ansible-vault edit
* CVE-2020-1746 ansible: Information disclosure issue in ldap_attr and
ldap_entry modules
* CVE-2020-1753 Ansible: kubectl connection plugin leaks sensitive
information
See:
https://github.com/ansible/ansible/blob/v2.9.7/changelogs/CHANGELOG-v2.9.rst
for details on bug fixes in this release.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ansible is now available for Ansible Engine 2.9\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ansible is a simple model-driven configuration management, multi-node\ndeployment, and remote-task execution system. Ansible works over SSH and\ndoes not require any software or daemons to be installed on remote nodes.\nExtension modules can be written in any language and are transferred to\nmanaged machines automatically.\n\nThe following packages have been upgraded to a newer upstream version:\nansible (2.9.7)\n\nBug Fix(es):\n* CVE-2020-10684 Ansible: code injection when using ansible_facts as a\nsubkey\n* CVE-2020-10685 Ansible: modules which use files encrypted with vault are\nnot properly cleaned up\n* CVE-2020-10691 Ansible: archive traversal vulnerability in ansible-galaxy\ncollection install\n* CVE-2020-1733 ansible: insecure temporary directory when running\nbecome_user from become directive\n* CVE-2020-1735 ansible: path injection on dest parameter in fetch module\n* CVE-2020-1737 ansible: Extract-Zip function in win_unzip module does not\ncheck extracted path\n* CVE-2020-1739 ansible: svn module leaks password when specified as a\nparameter\n* CVE-2020-1740 ansible: secrets readable after ansible-vault edit\n* CVE-2020-1746 ansible: Information disclosure issue in ldap_attr and\nldap_entry modules\n* CVE-2020-1753 Ansible: kubectl connection plugin leaks sensitive\ninformation\n\nSee:\nhttps://github.com/ansible/ansible/blob/v2.9.7/changelogs/CHANGELOG-v2.9.rst\nfor details on bug fixes in this release.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:1541",
"url": "https://access.redhat.com/errata/RHSA-2020:1541"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1801735",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801735"
},
{
"category": "external",
"summary": "1802085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802085"
},
{
"category": "external",
"summary": "1802154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802154"
},
{
"category": "external",
"summary": "1802178",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802178"
},
{
"category": "external",
"summary": "1802193",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802193"
},
{
"category": "external",
"summary": "1805491",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805491"
},
{
"category": "external",
"summary": "1811008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811008"
},
{
"category": "external",
"summary": "1814627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814627"
},
{
"category": "external",
"summary": "1815519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1815519"
},
{
"category": "external",
"summary": "1817161",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1817161"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1541.json"
}
],
"title": "Red Hat Security Advisory: Ansible security and bug fix update (2.9.7)",
"tracking": {
"current_release_date": "2024-11-05T22:06:49+00:00",
"generator": {
"date": "2024-11-05T22:06:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2020:1541",
"initial_release_date": "2020-04-22T14:10:47+00:00",
"revision_history": [
{
"date": "2020-04-22T14:10:47+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-04-22T14:10:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T22:06:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product": {
"name": "Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.9",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2.9::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2.9 for RHEL 8",
"product": {
"name": "Red Hat Ansible Engine 2.9 for RHEL 8",
"product_id": "8Base-Ansible-2.9",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2.9::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Engine"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.7-1.el7ae.noarch",
"product": {
"name": "ansible-0:2.9.7-1.el7ae.noarch",
"product_id": "ansible-0:2.9.7-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.7-1.el7ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.9.7-1.el7ae.noarch",
"product": {
"name": "ansible-test-0:2.9.7-1.el7ae.noarch",
"product_id": "ansible-test-0:2.9.7-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.9.7-1.el7ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.9.7-1.el8ae.noarch",
"product": {
"name": "ansible-0:2.9.7-1.el8ae.noarch",
"product_id": "ansible-0:2.9.7-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.7-1.el8ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.9.7-1.el8ae.noarch",
"product": {
"name": "ansible-test-0:2.9.7-1.el8ae.noarch",
"product_id": "ansible-test-0:2.9.7-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.9.7-1.el8ae?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.7-1.el7ae.src",
"product": {
"name": "ansible-0:2.9.7-1.el7ae.src",
"product_id": "ansible-0:2.9.7-1.el7ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.7-1.el7ae?arch=src"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.9.7-1.el8ae.src",
"product": {
"name": "ansible-0:2.9.7-1.el8ae.src",
"product_id": "ansible-0:2.9.7-1.el8ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.7-1.el8ae?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.7-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch"
},
"product_reference": "ansible-0:2.9.7-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.7-1.el7ae.src as a component of Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src"
},
"product_reference": "ansible-0:2.9.7-1.el7ae.src",
"relates_to_product_reference": "7Server-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.9.7-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 7 Server",
"product_id": "7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch"
},
"product_reference": "ansible-test-0:2.9.7-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.7-1.el8ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 8",
"product_id": "8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch"
},
"product_reference": "ansible-0:2.9.7-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.7-1.el8ae.src as a component of Red Hat Ansible Engine 2.9 for RHEL 8",
"product_id": "8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src"
},
"product_reference": "ansible-0:2.9.7-1.el8ae.src",
"relates_to_product_reference": "8Base-Ansible-2.9"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.9.7-1.el8ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 8",
"product_id": "8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
},
"product_reference": "ansible-test-0:2.9.7-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2.9"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-1733",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1801735"
}
],
"notes": [
{
"category": "description",
"text": "A race condition flaw was found in Ansible Engine when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with \"umask 77 \u0026\u0026 mkdir -p \u003cdir\u003e\"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating \u0027/proc/\u003cpid\u003e/cmdline\u0027.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: insecure temporary directory when running become_user from become directive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1733"
},
{
"category": "external",
"summary": "RHBZ#1801735",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801735"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1733",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1733"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1733",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1733"
}
],
"release_date": "2020-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:47+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1541"
},
{
"category": "workaround",
"details": "This issue can be mitigated by mounting the proc filesystem with hidepid=2 option (https://www.kernel.org/doc/Documentation/filesystems/proc.txt). This way only the user used by Ansible will be able to perform the attack as users on the system will be able to access only their processes /proc/$PID/ directories.\n\nAlso note that mounting proc filesystem with hidepid=2 might require re-mounting it on unpatched kernels, due to a kernel bug (see https://unix.stackexchange.com/questions/584054/why-procfs-mount-option-only-working-on-remount), there will be hidepid=3 in the future (https://patchwork.kernel.org/patch/11310217/).",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ansible: insecure temporary directory when running become_user from become directive"
},
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-1735",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1802085"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: path injection on dest parameter in fetch module",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1735"
},
{
"category": "external",
"summary": "RHBZ#1802085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1735",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1735"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1735",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1735"
}
],
"release_date": "2020-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:47+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1541"
},
{
"category": "workaround",
"details": "Currently, there is no mitigation for this issue except avoid using the affected fetch module when possible.",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ansible: path injection on dest parameter in fetch module"
},
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-1737",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2020-02-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1802154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Ansible Engine when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: Extract-Zip function in win_unzip module does not check extracted path",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1737"
},
{
"category": "external",
"summary": "RHBZ#1802154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1737",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1737"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1737",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1737"
}
],
"release_date": "2020-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:47+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1541"
},
{
"category": "workaround",
"details": "Currently, there is no mitigation for this issue except avoid using the affected win_unzip module when possible.",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ansible: Extract-Zip function in win_unzip module does not check extracted path"
},
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-1739",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1802178"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Ansible Engine. When a password is set with the argument \"password\" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: svn module leaks password when specified as a parameter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1739"
},
{
"category": "external",
"summary": "RHBZ#1802178",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802178"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1739",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1739"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1739",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1739"
}
],
"release_date": "2020-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:47+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1541"
},
{
"category": "workaround",
"details": "Instead of using the parameter \u0027password\u0027 of the subversion module, provide the password with stdin.",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.9,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ansible: svn module leaks password when specified as a parameter"
},
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-1740",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1802193"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes \"ansible-vault edit\", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: secrets readable after ansible-vault edit",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1740"
},
{
"category": "external",
"summary": "RHBZ#1802193",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802193"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1740",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1740"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1740",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1740"
}
],
"release_date": "2020-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:47+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1541"
},
{
"category": "workaround",
"details": "Currently, there is no mitigation for this issue except avoid using the \u0027edit\u0027 option from \u0027ansible-vault\u0027 command line tool.",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.9,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ansible: secrets readable after ansible-vault edit"
},
{
"acknowledgments": [
{
"names": [
"Felix Fountein"
]
}
],
"cve": "CVE-2020-1746",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2019-12-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1805491"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Ansible Engine when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: Information disclosure issue in ldap_attr and ldap_entry modules",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\n* Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains their own version of Ansible. The fix will be provided from core Ansible. But we still ship ansible separately for ceph ubuntu.\n\n* In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1746"
},
{
"category": "external",
"summary": "RHBZ#1805491",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805491"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1746",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1746"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1746",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1746"
}
],
"release_date": "2020-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:47+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1541"
},
{
"category": "workaround",
"details": "Using args keyword and embedding the ldap_auth variable instead of using bind_pw parameter would mitigate this issue.",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ansible: Information disclosure issue in ldap_attr and ldap_entry modules"
},
{
"acknowledgments": [
{
"names": [
"Abhijeet Kasurde"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2020-1753",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"discovery_date": "2020-03-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1811008"
}
],
"notes": [
{
"category": "description",
"text": "A security flaw was found in the Ansible Engine when managing Kubernetes using the k8s connection plugin. Sensitive parameters such as passwords and tokens are passed to the kubectl command line instead of using environment variables or an input configuration file, which is safer. This flaw discloses passwords and tokens from the process list, and the no_log directive from the debug module would not be reflected in the underlying command-line tools options, displaying passwords and tokens on stdout and log files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: kubectl connection plugin leaks sensitive information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.7.17, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1753"
},
{
"category": "external",
"summary": "RHBZ#1811008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1753",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1753"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1753",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1753"
}
],
"release_date": "2020-03-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:47+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1541"
},
{
"category": "workaround",
"details": "Currently, there is no mitigation for this issue.",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Ansible: kubectl connection plugin leaks sensitive information"
},
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-10684",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1815519"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Ansible Engine. When using ansible_facts as a subkey of itself, and promoting it to a variable when injecting is enabled, overwriting the ansible_facts after the clean, an attacker could take advantage of this by altering the ansible_facts leading to privilege escalation or code injection. The highest threat from this vulnerability are to data integrity and system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: code injection when using ansible_facts as a subkey",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n* Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains their own version of Ansible. The fix will be consumed from core Ansible. But we still ship ansible separately for ceph ubuntu.\n* Red Hat OpenStack Platform does package the affected code. However, because RHOSP does not use ansible_facts as a subkey directly, the RHOSP impact has been reduced to Moderate and no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10684"
},
{
"category": "external",
"summary": "RHBZ#1815519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1815519"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10684",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10684"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10684",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10684"
}
],
"release_date": "2020-03-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:47+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1541"
},
{
"category": "workaround",
"details": "Currently, there is not a known mitigation except avoiding the functionality of using ansible_facts as a subkey.",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Ansible: code injection when using ansible_facts as a subkey"
},
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-10685",
"cwe": {
"id": "CWE-459",
"name": "Incomplete Cleanup"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1814627"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found on Ansible Engine when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the secrets unencrypted.\r\n\r\nOn Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decrypted data remains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted is sensible.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: modules which use files encrypted with vault are not properly cleaned up",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\n* In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10685"
},
{
"category": "external",
"summary": "RHBZ#1814627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10685",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10685"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10685",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10685"
}
],
"release_date": "2020-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:47+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1541"
},
{
"category": "workaround",
"details": "Currently, there is no mitigation for this issue except by removing manually the temporary created file after every run.",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Ansible: modules which use files encrypted with vault are not properly cleaned up"
},
{
"acknowledgments": [
{
"names": [
"Felix Fountein"
]
}
],
"cve": "CVE-2020-10691",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2020-03-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1817161"
}
],
"notes": [
{
"category": "description",
"text": "An archive traversal flaw was found in Ansible Engine when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: archive traversal vulnerability in ansible-galaxy collection install",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.9.6 as well as previous 2.9.x versions are affected. Ansible versions less than or equal to 2.8 are not affected by this vulnerability as this functionality was introduced on 2.9.\n\nAnsible Tower 3.6.3 as well as previous 3.6.x versions are affected as they use ansible-galaxy collections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10691"
},
{
"category": "external",
"summary": "RHBZ#1817161",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1817161"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10691",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10691"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10691",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10691"
}
],
"release_date": "2020-03-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:47+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1541"
},
{
"category": "workaround",
"details": "A possible mitigation of archive traversal issue could be done by restricting file access control and directory write accesses for extracting tarball files. This is feasible only for scenarios when the destination path could be known and enforced beforehand.",
"product_ids": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2.9:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2.9:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2.9:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2.9:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Ansible: archive traversal vulnerability in ansible-galaxy collection install"
}
]
}
rhba-2020_1540
Vulnerability from csaf_redhat
Published
2020-04-22 13:21
Modified
2024-11-05 15:55
Summary
Red Hat Bug Fix Advisory: Red Hat Ansible Tower 3.6.4-1 - RHEL7 Container
Notes
Topic
Red Hat Ansible Tower 3.6.4-1 - RHEL7 Container
Details
* Added additional metrics to the Prometheus /api/v2/metrics/ endpoint for reporting remaining instance capacity
* Fixed Tower to allow users to subscribe to playbook output in organizations they do not have RBAC access to via Towers websocket interface (CVE-2020-10698)
* Fixed OAuth2 refresh tokens to properly respect custom expiration settings (CVE-2020-10709)
* Fixed event hostnames to be recorded for playbooks run on isolated nodes
* Fixed a PostgreSQL issue that caused upgrade failures in certain situations
* Fixed the search for Source Control credentials in the Tower user interface
* Fixed a performance issue to no longer delay the output of project updates for certain users
* Fixed the installations to no longer fail with admin passwords that contain certain special characters
* Fixed the start time to correctly set for approval notifications
* Fixed an inconsistency in gathered inventory analytics
* Improved memcached in OpenShift deployments to listen on a more secure domain socket (CVE-2020-10697)
* Updated single sign-on integration to address several upcoming GitHub API deprecations
* Updated the Twisted library to address CVE-2020-10108 and CVE-2020-10109
* Updated translations
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Ansible Tower 3.6.4-1 - RHEL7 Container",
"title": "Topic"
},
{
"category": "general",
"text": "* Added additional metrics to the Prometheus /api/v2/metrics/ endpoint for reporting remaining instance capacity\n* Fixed Tower to allow users to subscribe to playbook output in organizations they do not have RBAC access to via Towers websocket interface (CVE-2020-10698)\n* Fixed OAuth2 refresh tokens to properly respect custom expiration settings (CVE-2020-10709)\n* Fixed event hostnames to be recorded for playbooks run on isolated nodes\n* Fixed a PostgreSQL issue that caused upgrade failures in certain situations\n* Fixed the search for Source Control credentials in the Tower user interface\n* Fixed a performance issue to no longer delay the output of project updates for certain users\n* Fixed the installations to no longer fail with admin passwords that contain certain special characters\n* Fixed the start time to correctly set for approval notifications\n* Fixed an inconsistency in gathered inventory analytics\n* Improved memcached in OpenShift deployments to listen on a more secure domain socket (CVE-2020-10697)\n* Updated single sign-on integration to address several upcoming GitHub API deprecations\n* Updated the Twisted library to address CVE-2020-10108 and CVE-2020-10109\n* Updated translations",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHBA-2020:1540",
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_1540.json"
}
],
"title": "Red Hat Bug Fix Advisory: Red Hat Ansible Tower 3.6.4-1 - RHEL7 Container",
"tracking": {
"current_release_date": "2024-11-05T15:55:54+00:00",
"generator": {
"date": "2024-11-05T15:55:54+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHBA-2020:1540",
"initial_release_date": "2020-04-22T13:21:59+00:00",
"revision_history": [
{
"date": "2020-04-22T13:21:59+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-04-22T13:21:59+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T15:55:54+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Tower 3.6 for RHEL 7",
"product": {
"name": "Red Hat Ansible Tower 3.6 for RHEL 7",
"product_id": "7Server-Ansible-Tower-3.6",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_tower:3.6::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Tower"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64",
"product": {
"name": "ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64",
"product_id": "ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-36/ansible-tower\u0026tag=3.6.4-1"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64 as a component of Red Hat Ansible Tower 3.6 for RHEL 7",
"product_id": "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
},
"product_reference": "ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64",
"relates_to_product_reference": "7Server-Ansible-Tower-3.6"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Mozilla project"
]
},
{
"names": [
"Ucha Gobejishvili"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2015-2716",
"discovery_date": "2015-05-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1220607"
}
],
"notes": [
{
"category": "description",
"text": "Buffer overflow in the XML parser in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 allows remote attackers to execute arbitrary code by providing a large amount of compressed XML data, a related issue to CVE-2015-1283.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "expat: Integer overflow leading to buffer overflow in XML_GetBuffer()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the version of expat package as shipped with Red Hat Enterprise Linux 5, 6 and 7. Red Hat Product Security has rated this issue as having Moderate security impact, a future update may address this flaw.\n\nRed Hat Enterprise Linux 5 is now in Extended Life Cycle phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-2716"
},
{
"category": "external",
"summary": "RHBZ#1220607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1220607"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-2716",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-2716"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-2716",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-2716"
},
{
"category": "external",
"summary": "http://www.mozilla.org/security/announce/2015/mfsa2015-54.html",
"url": "http://www.mozilla.org/security/announce/2015/mfsa2015-54.html"
}
],
"release_date": "2015-05-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "expat: Integer overflow leading to buffer overflow in XML_GetBuffer()"
},
{
"cve": "CVE-2015-8035",
"cwe": {
"id": "CWE-252",
"name": "Unchecked Return Value"
},
"discovery_date": "2015-11-02T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1277146"
}
],
"notes": [
{
"category": "description",
"text": "A denial of service flaw was found in libxml2. A remote attacker could provide a specially crafted XML or HTML file that, when processed by an application using libxml2, would cause that application to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: DoS caused by incorrect error detection during XZ decompression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue did not affect the versions of libxml2 as shipped with Red Hat Enterprise Linux 5 and 6 as they did not include support for LZMA compression support.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2015-8035"
},
{
"category": "external",
"summary": "RHBZ#1277146",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1277146"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2015-8035",
"url": "https://www.cve.org/CVERecord?id=CVE-2015-8035"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-8035",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-8035"
}
],
"release_date": "2015-11-02T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: DoS caused by incorrect error detection during XZ decompression"
},
{
"cve": "CVE-2016-5131",
"discovery_date": "2016-07-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1358641"
}
],
"notes": [
{
"category": "description",
"text": "Use-after-free vulnerability in libxml2 through 2.9.4, as used in Google Chrome before 52.0.2743.82, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to the XPointer range-to function.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Use after free triggered by XPointer paths beginning with range-to",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in libxml2 requires exposing the library to XPath/XPointer expressions from an untrusted source, which is not common in practice for applications using libxml2. For libxml2, Red Hat Product Security has rated this vulnerability as Moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-5131"
},
{
"category": "external",
"summary": "RHBZ#1358641",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1358641"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-5131",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-5131"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-5131",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-5131"
},
{
"category": "external",
"summary": "https://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html",
"url": "https://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html"
}
],
"release_date": "2016-07-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml2: Use after free triggered by XPointer paths beginning with range-to"
},
{
"cve": "CVE-2017-15412",
"discovery_date": "2017-12-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1523128"
}
],
"notes": [
{
"category": "description",
"text": "A use-after-free flaw was found in the libxml2 library. An attacker could use this flaw to cause an application linked against libxml2 to crash when parsing a specially crafted XML file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-15412"
},
{
"category": "external",
"summary": "RHBZ#1523128",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1523128"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-15412",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-15412"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-15412",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15412"
},
{
"category": "external",
"summary": "https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html",
"url": "https://chromereleases.googleblog.com/2017/12/stable-channel-update-for-desktop.html"
}
],
"release_date": "2017-12-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libxml2: Use after free in xmlXPathCompOpEvalPositionalPredicate() function in xpath.c"
},
{
"cve": "CVE-2017-18258",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2018-04-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1566749"
}
],
"notes": [
{
"category": "description",
"text": "The xz_head function in xzlib.c in libxml2 before 2.9.6 allows remote attackers to cause a denial of service (memory consumption) via a crafted LZMA file, because the decoder functionality does not restrict memory usage to what is required for a legitimate file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Unrestricted memory usage in xz_head() function in xzlib.c",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2017-18258"
},
{
"category": "external",
"summary": "RHBZ#1566749",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1566749"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2017-18258",
"url": "https://www.cve.org/CVERecord?id=CVE-2017-18258"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-18258",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18258"
}
],
"release_date": "2017-09-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Unrestricted memory usage in xz_head() function in xzlib.c"
},
{
"cve": "CVE-2018-10360",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2018-06-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1590000"
}
],
"notes": [
{
"category": "description",
"text": "The do_core_note function in readelf.c in libmagic.a in file 5.33 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted ELF file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "file: out-of-bounds read via a crafted ELF file",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-10360"
},
{
"category": "external",
"summary": "RHBZ#1590000",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1590000"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-10360",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-10360"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10360",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10360"
}
],
"release_date": "2018-06-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "file: out-of-bounds read via a crafted ELF file"
},
{
"cve": "CVE-2018-14404",
"cwe": {
"id": "CWE-476",
"name": "NULL Pointer Dereference"
},
"discovery_date": "2018-06-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1595985"
}
],
"notes": [
{
"category": "description",
"text": "A null pointer dereference vulnerability exists in the xpath.c:xmlXPathCompOpEval() function of libxml2 when parsing invalid XPath expression. Applications processing untrusted XSL format inputs with the use of libxml2 library may be vulnerable to denial of service attack due to crash of the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of libxml2 as shipped with Red Hat Enterprise Linux 5. Red Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nThis issue affects the versions of libxml2 as shipped with Red Hat Enterprise Linux 6. Red Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nThis issue affects the versions of libxml2 as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having a security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-14404"
},
{
"category": "external",
"summary": "RHBZ#1595985",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595985"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-14404",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14404"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14404",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14404"
}
],
"release_date": "2018-06-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libxml2: NULL pointer dereference in xmlXPathCompOpEval() function in xpath.c"
},
{
"cve": "CVE-2018-14567",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2018-08-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1619875"
}
],
"notes": [
{
"category": "description",
"text": "libxml2 2.9.8, if --with-lzma is used, allows remote attackers to cause a denial of service (infinite loop) via a crafted XML file that triggers LZMA_MEMLIMIT_ERROR, as demonstrated by xmllint, a different vulnerability than CVE-2015-8035 and CVE-2018-9251.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Infinite loop caused by incorrect error detection during LZMA decompression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this flaw as having Low impact. A future update may address this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-14567"
},
{
"category": "external",
"summary": "RHBZ#1619875",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1619875"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-14567",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-14567"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14567",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14567"
}
],
"release_date": "2018-04-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Infinite loop caused by incorrect error detection during LZMA decompression"
},
{
"cve": "CVE-2018-18074",
"cwe": {
"id": "CWE-522",
"name": "Insufficiently Protected Credentials"
},
"discovery_date": "2018-10-10T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1643829"
}
],
"notes": [
{
"category": "description",
"text": "A credentials-exposure flaw was found in python-requests, where if a request with authentication is redirected (302) from an HTTPS endpoint to an HTTP endpoint on the same host, the Authorization header is not stripped and the credentials can be read in plain text. A man-in-the-middle attacker could exploit this flaw to obtain a user\u0027s valid credentials.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-requests: Redirect from HTTPS to HTTP does not remove Authorization header",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-18074"
},
{
"category": "external",
"summary": "RHBZ#1643829",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1643829"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-18074",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-18074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-18074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18074"
}
],
"release_date": "2018-06-29T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 2.6,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "python-requests: Redirect from HTTPS to HTTP does not remove Authorization header"
},
{
"cve": "CVE-2018-20060",
"cwe": {
"id": "CWE-522",
"name": "Insufficiently Protected Credentials"
},
"discovery_date": "2018-11-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1649153"
}
],
"notes": [
{
"category": "description",
"text": "urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Satellite 6.2 is on Maintenance Support 2 phase, hence only selected critical and important issues will be fixed. Please refer to Red Hat Satellite Product Life Cycle page for more information.\n\nIn Red Hat OpenStack Platform 13, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-urllib3 package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-20060"
},
{
"category": "external",
"summary": "RHBZ#1649153",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1649153"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-20060",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20060"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-20060",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20060"
}
],
"release_date": "2018-03-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
},
{
"category": "workaround",
"details": "Use `retries=urllib3.Retry(redirect=0)` when performing requests if you do not need redirection and handle the redirects manually if you need them.",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-urllib3: Cross-host redirect does not remove Authorization header allow for credential exposure"
},
{
"cve": "CVE-2018-20852",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2019-07-14T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1740347"
}
],
"notes": [
{
"category": "description",
"text": "http.cookiejar.DefaultPolicy.domain_return_ok in Lib/http/cookiejar.py in Python before 3.7.3 does not correctly validate the domain: it can be tricked into sending existing cookies to the wrong server. An attacker may abuse this flaw by using a server with a hostname that has another valid hostname as a suffix (e.g., pythonicexample.com to steal cookies for example.com). When a program uses http.cookiejar.DefaultPolicy and tries to do an HTTP connection to an attacker-controlled server, existing cookies can be leaked to the attacker. This affects 2.x through 2.7.16, 3.x before 3.4.10, 3.5.x before 3.5.7, 3.6.x before 3.6.9, and 3.7.x before 3.7.3.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: Cookie domain check returns incorrect results",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the versions of python as shipped with Red Hat Enterprise Linux 5, 6, and 7. This issue affects the versions of python3 as shipped with Red Hat Enterprise Linux 7 and 8. This issue affects the versions of python2 and python36 as shipped with Red Hat Enterprise Linux 8.\n\nRed Hat Enterprise Linux 5 is now in Extended Life Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.\n\nRed Hat Enterprise Linux 6 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2018-20852"
},
{
"category": "external",
"summary": "RHBZ#1740347",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1740347"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2018-20852",
"url": "https://www.cve.org/CVERecord?id=CVE-2018-20852"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-20852",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20852"
}
],
"release_date": "2018-10-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
},
{
"category": "workaround",
"details": "A potentially simple workaround in the absence of patch on affected versions is to set DomainStrict in the cookiepolicy that would make sure a literal match against domain. The disadvantage would be that cookie set on example.com would not be shared with subdomain which might break workflow.",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python: Cookie domain check returns incorrect results"
},
{
"acknowledgments": [
{
"names": [
"Ray Strode"
],
"organization": "The GNOME Project"
},
{
"names": [
"Maxime Vellard"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2019-3820",
"cwe": {
"id": "CWE-285",
"name": "Improper Authorization"
},
"discovery_date": "2019-01-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1669391"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability was found where the gnome-shell lock screen, since version 3.15.91, does not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts and potentially other actions. This vulnerability was fixed in gnome-shell 3.31.5 and 3.30.3.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "gnome-shell: partial lock screen bypass",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-3820"
},
{
"category": "external",
"summary": "RHBZ#1669391",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1669391"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-3820",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-3820"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3820",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3820"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/gnome-shell/issues/851",
"url": "https://gitlab.gnome.org/GNOME/gnome-shell/issues/851"
}
],
"release_date": "2019-02-05T12:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "LOW",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:P/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "gnome-shell: partial lock screen bypass"
},
{
"acknowledgments": [
{
"names": [
"the Curl project"
]
},
{
"names": [
"l00p3r"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2019-5436",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2019-05-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1710620"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "curl: TFTP receive heap buffer overflow in tftp_receive_packet() function",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw exists if the user selects to use a \"blksize\" of 504 or smaller (default is 512). The smaller size that is used, the larger the possible overflow becomes.\nUsers choosing a smaller size than default should be rare as the primary use case for changing the size is to make it larger. It is rare for users to use TFTP across the Internet. It is most commonly used within local networks.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-5436"
},
{
"category": "external",
"summary": "RHBZ#1710620",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1710620"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-5436",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-5436"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5436",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5436"
},
{
"category": "external",
"summary": "https://curl.haxx.se/docs/CVE-2019-5436.html",
"url": "https://curl.haxx.se/docs/CVE-2019-5436.html"
}
],
"release_date": "2019-05-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "curl: TFTP receive heap buffer overflow in tftp_receive_packet() function"
},
{
"cve": "CVE-2019-9924",
"cwe": {
"id": "CWE-138",
"name": "Improper Neutralization of Special Elements"
},
"discovery_date": "2019-03-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1691774"
}
],
"notes": [
{
"category": "description",
"text": "rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "bash: BASH_CMD is writable in restricted bash shells",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Impact of the flaw set to Moderate as restricted shell shall not be used as a security feature alone, as it is very hard to configure it properly and several bypasses exist for it.\n\nThis issue did not affect the versions of bash as shipped with Red Hat Enterprise Linux 5 as they did not include support for BASH_CMDS environment variable.\n\nRed Hat Virtualization Hypervisor and Management Appliance were affected by this issue, but do not use the restricted bash shell in a way that would be exposed to attackers. Future updates may address this issue.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-9924"
},
{
"category": "external",
"summary": "RHBZ#1691774",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1691774"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-9924",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-9924"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-9924",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9924"
}
],
"release_date": "2019-03-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "bash: BASH_CMD is writable in restricted bash shells"
},
{
"cve": "CVE-2019-11236",
"cwe": {
"id": "CWE-113",
"name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)"
},
"discovery_date": "2019-04-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1700824"
}
],
"notes": [
{
"category": "description",
"text": "In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python-urllib3: CRLF injection due to not encoding the \u0027\\r\\n\u0027 sequence leading to possible attack on internal service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This issue affects the version of python-urllib3 shipped with Red Hat Gluster Storage 3, as it is vulnerable to CRLF injection.\n\nRed Hat Satellite 6.2 is on Maintenance Support 2 phase, hence only selected critical and important issues will be fixed. Please refer to Red Hat Satellite Product Life Cycle page for more information.\n\nIn Red Hat OpenStack Platform 13, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-urllib3 package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-11236"
},
{
"category": "external",
"summary": "RHBZ#1700824",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1700824"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-11236",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-11236"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11236",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11236"
}
],
"release_date": "2019-03-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python-urllib3: CRLF injection due to not encoding the \u0027\\r\\n\u0027 sequence leading to possible attack on internal service"
},
{
"cve": "CVE-2019-16056",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2019-09-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1749839"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in Python through 2.7.16, 3.x through 3.5.7, 3.6.x through 3.6.9, and 3.7.x through 3.7.4. The email module wrongly parses email addresses that contain multiple @ characters. An application that uses the email module and implements some kind of checks on the From/To headers of a message could be tricked into accepting an email address that should be denied. An attack may be the same as in CVE-2019-11340; however, this CVE applies to Python more generally.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: email.utils.parseaddr wrongly parses email addresses",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-16056"
},
{
"category": "external",
"summary": "RHBZ#1749839",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1749839"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-16056",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-16056"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-16056",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-16056"
}
],
"release_date": "2018-07-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "python: email.utils.parseaddr wrongly parses email addresses"
},
{
"cve": "CVE-2019-17041",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2019-10-29T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1766693"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in Rsyslog v8.1908.0. contrib/pmaixforwardedfrom/pmaixforwardedfrom.c has a heap overflow in the parser for AIX log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon) but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-17041"
},
{
"category": "external",
"summary": "RHBZ#1766693",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1766693"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-17041",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17041"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17041",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17041"
}
],
"release_date": "2019-09-30T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsyslog: heap-based overflow in contrib/pmaixforwardedfrom/pmaixforwardedfrom.c"
},
{
"cve": "CVE-2019-17042",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2019-10-29T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1766700"
}
],
"notes": [
{
"category": "description",
"text": "An issue was discovered in Rsyslog v8.1908.0. contrib/pmcisconames/pmcisconames.c has a heap overflow in the parser for Cisco log messages. The parser tries to locate a log message delimiter (in this case, a space or a colon), but fails to account for strings that do not satisfy this constraint. If the string does not match, then the variable lenMsg will reach the value zero and will skip the sanity check that detects invalid log messages. The message will then be considered valid, and the parser will eat up the nonexistent colon delimiter. In doing so, it will decrement lenMsg, a signed integer, whose value was zero and now becomes minus one. The following step in the parser is to shift left the contents of the message. To do this, it will call memmove with the right pointers to the target and destination strings, but the lenMsg will now be interpreted as a huge value, causing a heap overflow.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rsyslog: heap-based overflow in contrib/pmcisconames/pmcisconames.c",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-17042"
},
{
"category": "external",
"summary": "RHBZ#1766700",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1766700"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-17042",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-17042"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17042",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17042"
}
],
"release_date": "2019-10-01T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rsyslog: heap-based overflow in contrib/pmcisconames/pmcisconames.c"
},
{
"acknowledgments": [
{
"names": [
"Felix Fountein"
]
}
],
"cve": "CVE-2020-10691",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2020-03-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1817161"
}
],
"notes": [
{
"category": "description",
"text": "An archive traversal flaw was found in Ansible Engine when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: archive traversal vulnerability in ansible-galaxy collection install",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.9.6 as well as previous 2.9.x versions are affected. Ansible versions less than or equal to 2.8 are not affected by this vulnerability as this functionality was introduced on 2.9.\n\nAnsible Tower 3.6.3 as well as previous 3.6.x versions are affected as they use ansible-galaxy collections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10691"
},
{
"category": "external",
"summary": "RHBZ#1817161",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1817161"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10691",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10691"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10691",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10691"
}
],
"release_date": "2020-03-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
},
{
"category": "workaround",
"details": "A possible mitigation of archive traversal issue could be done by restricting file access control and directory write accesses for extracting tarball files. This is feasible only for scenarios when the destination path could be known and enforced beforehand.",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Ansible: archive traversal vulnerability in ansible-galaxy collection install"
},
{
"acknowledgments": [
{
"names": [
"Rihards Olups"
]
}
],
"cve": "CVE-2020-10729",
"cwe": {
"id": "CWE-330",
"name": "Use of Insufficiently Random Values"
},
"discovery_date": "2020-05-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1831089"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: two random password lookups in same task return same value",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10729"
},
{
"category": "external",
"summary": "RHBZ#1831089",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1831089"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10729",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10729"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10729",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10729"
},
{
"category": "external",
"summary": "https://github.com/ansible/ansible/issues/34144",
"url": "https://github.com/ansible/ansible/issues/34144"
}
],
"release_date": "2017-12-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T13:21:59+00:00",
"details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html",
"product_ids": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHBA-2020:1540"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:a0f23b14edea9a3983614d21c8532d6ef6bf760c56d8249cc452b87eeba60f0f_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Ansible: two random password lookups in same task return same value"
}
]
}
rhsa-2020_1542
Vulnerability from csaf_redhat
Published
2020-04-22 14:10
Modified
2024-11-05 22:06
Summary
Red Hat Security Advisory: Ansible security and bug fix update (2.9.7)
Notes
Topic
An update for ansible is now available for Ansible Engine 2
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node
deployment, and remote-task execution system. Ansible works over SSH and
does not require any software or daemons to be installed on remote nodes.
Extension modules can be written in any language and are transferred to
managed machines automatically.
The following packages have been upgraded to a newer upstream version:
ansible (2.9.7)
Bug Fix(es):
* CVE-2020-10684 Ansible: code injection when using ansible_facts as a
subkey
* CVE-2020-10685 Ansible: modules which use files encrypted with vault are
not properly cleaned up
* CVE-2020-10691 Ansible: archive traversal vulnerability in ansible-galaxy
collection install
* CVE-2020-1733 ansible: insecure temporary directory when running
become_user from become directive
* CVE-2020-1735 ansible: path injection on dest parameter in fetch module
* CVE-2020-1737 ansible: Extract-Zip function in win_unzip module does not
check extracted path
* CVE-2020-1739 ansible: svn module leaks password when specified as a
parameter
* CVE-2020-1740 ansible: secrets readable after ansible-vault edit
* CVE-2020-1746 ansible: Information disclosure issue in ldap_attr and
ldap_entry modules
* CVE-2020-1753 Ansible: kubectl connection plugin leaks sensitive
information
See:
https://github.com/ansible/ansible/blob/v2.9.7/changelogs/CHANGELOG-v2.9.rst
for details on bug fixes in this release.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ansible is now available for Ansible Engine 2\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ansible is a simple model-driven configuration management, multi-node\ndeployment, and remote-task execution system. Ansible works over SSH and\ndoes not require any software or daemons to be installed on remote nodes.\nExtension modules can be written in any language and are transferred to\nmanaged machines automatically.\n\nThe following packages have been upgraded to a newer upstream version:\nansible (2.9.7)\n\nBug Fix(es):\n* CVE-2020-10684 Ansible: code injection when using ansible_facts as a\nsubkey\n* CVE-2020-10685 Ansible: modules which use files encrypted with vault are\nnot properly cleaned up\n* CVE-2020-10691 Ansible: archive traversal vulnerability in ansible-galaxy\ncollection install\n* CVE-2020-1733 ansible: insecure temporary directory when running\nbecome_user from become directive\n* CVE-2020-1735 ansible: path injection on dest parameter in fetch module\n* CVE-2020-1737 ansible: Extract-Zip function in win_unzip module does not\ncheck extracted path\n* CVE-2020-1739 ansible: svn module leaks password when specified as a\nparameter\n* CVE-2020-1740 ansible: secrets readable after ansible-vault edit\n* CVE-2020-1746 ansible: Information disclosure issue in ldap_attr and\nldap_entry modules\n* CVE-2020-1753 Ansible: kubectl connection plugin leaks sensitive\ninformation\n\nSee:\nhttps://github.com/ansible/ansible/blob/v2.9.7/changelogs/CHANGELOG-v2.9.rst\nfor details on bug fixes in this release.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2020:1542",
"url": "https://access.redhat.com/errata/RHSA-2020:1542"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "1801735",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801735"
},
{
"category": "external",
"summary": "1802085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802085"
},
{
"category": "external",
"summary": "1802154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802154"
},
{
"category": "external",
"summary": "1802178",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802178"
},
{
"category": "external",
"summary": "1802193",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802193"
},
{
"category": "external",
"summary": "1805491",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805491"
},
{
"category": "external",
"summary": "1811008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811008"
},
{
"category": "external",
"summary": "1814627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814627"
},
{
"category": "external",
"summary": "1815519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1815519"
},
{
"category": "external",
"summary": "1817161",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1817161"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1542.json"
}
],
"title": "Red Hat Security Advisory: Ansible security and bug fix update (2.9.7)",
"tracking": {
"current_release_date": "2024-11-05T22:06:56+00:00",
"generator": {
"date": "2024-11-05T22:06:56+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2020:1542",
"initial_release_date": "2020-04-22T14:10:54+00:00",
"revision_history": [
{
"date": "2020-04-22T14:10:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2020-04-22T14:10:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T22:06:56+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2 for RHEL 7",
"product": {
"name": "Red Hat Ansible Engine 2 for RHEL 7",
"product_id": "7Server-Ansible-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Ansible Engine 2 for RHEL 8",
"product": {
"name": "Red Hat Ansible Engine 2 for RHEL 8",
"product_id": "8Base-Ansible-2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_engine:2::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Engine"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.7-1.el7ae.noarch",
"product": {
"name": "ansible-0:2.9.7-1.el7ae.noarch",
"product_id": "ansible-0:2.9.7-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.7-1.el7ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.9.7-1.el7ae.noarch",
"product": {
"name": "ansible-test-0:2.9.7-1.el7ae.noarch",
"product_id": "ansible-test-0:2.9.7-1.el7ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.9.7-1.el7ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.9.7-1.el8ae.noarch",
"product": {
"name": "ansible-0:2.9.7-1.el8ae.noarch",
"product_id": "ansible-0:2.9.7-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.7-1.el8ae?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-test-0:2.9.7-1.el8ae.noarch",
"product": {
"name": "ansible-test-0:2.9.7-1.el8ae.noarch",
"product_id": "ansible-test-0:2.9.7-1.el8ae.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-test@2.9.7-1.el8ae?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ansible-0:2.9.7-1.el7ae.src",
"product": {
"name": "ansible-0:2.9.7-1.el7ae.src",
"product_id": "ansible-0:2.9.7-1.el7ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.7-1.el7ae?arch=src"
}
}
},
{
"category": "product_version",
"name": "ansible-0:2.9.7-1.el8ae.src",
"product": {
"name": "ansible-0:2.9.7-1.el8ae.src",
"product_id": "ansible-0:2.9.7-1.el8ae.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible@2.9.7-1.el8ae?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.7-1.el7ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7",
"product_id": "7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch"
},
"product_reference": "ansible-0:2.9.7-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.7-1.el7ae.src as a component of Red Hat Ansible Engine 2 for RHEL 7",
"product_id": "7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src"
},
"product_reference": "ansible-0:2.9.7-1.el7ae.src",
"relates_to_product_reference": "7Server-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.9.7-1.el7ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7",
"product_id": "7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch"
},
"product_reference": "ansible-test-0:2.9.7-1.el7ae.noarch",
"relates_to_product_reference": "7Server-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.7-1.el8ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 8",
"product_id": "8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch"
},
"product_reference": "ansible-0:2.9.7-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-0:2.9.7-1.el8ae.src as a component of Red Hat Ansible Engine 2 for RHEL 8",
"product_id": "8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src"
},
"product_reference": "ansible-0:2.9.7-1.el8ae.src",
"relates_to_product_reference": "8Base-Ansible-2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-test-0:2.9.7-1.el8ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 8",
"product_id": "8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
},
"product_reference": "ansible-test-0:2.9.7-1.el8ae.noarch",
"relates_to_product_reference": "8Base-Ansible-2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-1733",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1801735"
}
],
"notes": [
{
"category": "description",
"text": "A race condition flaw was found in Ansible Engine when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with \"umask 77 \u0026\u0026 mkdir -p \u003cdir\u003e\"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating \u0027/proc/\u003cpid\u003e/cmdline\u0027.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: insecure temporary directory when running become_user from become directive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1733"
},
{
"category": "external",
"summary": "RHBZ#1801735",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801735"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1733",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1733"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1733",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1733"
}
],
"release_date": "2020-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:54+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1542"
},
{
"category": "workaround",
"details": "This issue can be mitigated by mounting the proc filesystem with hidepid=2 option (https://www.kernel.org/doc/Documentation/filesystems/proc.txt). This way only the user used by Ansible will be able to perform the attack as users on the system will be able to access only their processes /proc/$PID/ directories.\n\nAlso note that mounting proc filesystem with hidepid=2 might require re-mounting it on unpatched kernels, due to a kernel bug (see https://unix.stackexchange.com/questions/584054/why-procfs-mount-option-only-working-on-remount), there will be hidepid=3 in the future (https://patchwork.kernel.org/patch/11310217/).",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ansible: insecure temporary directory when running become_user from become directive"
},
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-1735",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1802085"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: path injection on dest parameter in fetch module",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1735"
},
{
"category": "external",
"summary": "RHBZ#1802085",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802085"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1735",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1735"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1735",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1735"
}
],
"release_date": "2020-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:54+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1542"
},
{
"category": "workaround",
"details": "Currently, there is no mitigation for this issue except avoid using the affected fetch module when possible.",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ansible: path injection on dest parameter in fetch module"
},
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-1737",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2020-02-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1802154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Ansible Engine when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: Extract-Zip function in win_unzip module does not check extracted path",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1737"
},
{
"category": "external",
"summary": "RHBZ#1802154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1737",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1737"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1737",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1737"
}
],
"release_date": "2020-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:54+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1542"
},
{
"category": "workaround",
"details": "Currently, there is no mitigation for this issue except avoid using the affected win_unzip module when possible.",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ansible: Extract-Zip function in win_unzip module does not check extracted path"
},
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-1739",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1802178"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Ansible Engine. When a password is set with the argument \"password\" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: svn module leaks password when specified as a parameter",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1739"
},
{
"category": "external",
"summary": "RHBZ#1802178",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802178"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1739",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1739"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1739",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1739"
}
],
"release_date": "2020-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:54+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1542"
},
{
"category": "workaround",
"details": "Instead of using the parameter \u0027password\u0027 of the subversion module, provide the password with stdin.",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.9,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ansible: svn module leaks password when specified as a parameter"
},
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-1740",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1802193"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes \"ansible-vault edit\", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: secrets readable after ansible-vault edit",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1740"
},
{
"category": "external",
"summary": "RHBZ#1802193",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802193"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1740",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1740"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1740",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1740"
}
],
"release_date": "2020-02-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:54+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1542"
},
{
"category": "workaround",
"details": "Currently, there is no mitigation for this issue except avoid using the \u0027edit\u0027 option from \u0027ansible-vault\u0027 command line tool.",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.9,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ansible: secrets readable after ansible-vault edit"
},
{
"acknowledgments": [
{
"names": [
"Felix Fountein"
]
}
],
"cve": "CVE-2020-1746",
"cwe": {
"id": "CWE-200",
"name": "Exposure of Sensitive Information to an Unauthorized Actor"
},
"discovery_date": "2019-12-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1805491"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Ansible Engine when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ansible: Information disclosure issue in ldap_attr and ldap_entry modules",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\n* Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains their own version of Ansible. The fix will be provided from core Ansible. But we still ship ansible separately for ceph ubuntu.\n\n* In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1746"
},
{
"category": "external",
"summary": "RHBZ#1805491",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805491"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1746",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1746"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1746",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1746"
}
],
"release_date": "2020-02-28T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:54+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1542"
},
{
"category": "workaround",
"details": "Using args keyword and embedding the ldap_auth variable instead of using bind_pw parameter would mitigate this issue.",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "ansible: Information disclosure issue in ldap_attr and ldap_entry modules"
},
{
"acknowledgments": [
{
"names": [
"Abhijeet Kasurde"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2020-1753",
"cwe": {
"id": "CWE-532",
"name": "Insertion of Sensitive Information into Log File"
},
"discovery_date": "2020-03-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1811008"
}
],
"notes": [
{
"category": "description",
"text": "A security flaw was found in the Ansible Engine when managing Kubernetes using the k8s connection plugin. Sensitive parameters such as passwords and tokens are passed to the kubectl command line instead of using environment variables or an input configuration file, which is safer. This flaw discloses passwords and tokens from the process list, and the no_log directive from the debug module would not be reflected in the underlying command-line tools options, displaying passwords and tokens on stdout and log files.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: kubectl connection plugin leaks sensitive information",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.7.17, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\nAnsible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-1753"
},
{
"category": "external",
"summary": "RHBZ#1811008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-1753",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-1753"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1753",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1753"
}
],
"release_date": "2020-03-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:54+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1542"
},
{
"category": "workaround",
"details": "Currently, there is no mitigation for this issue.",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Ansible: kubectl connection plugin leaks sensitive information"
},
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-10684",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1815519"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Ansible Engine. When using ansible_facts as a subkey of itself, and promoting it to a variable when injecting is enabled, overwriting the ansible_facts after the clean, an attacker could take advantage of this by altering the ansible_facts leading to privilege escalation or code injection. The highest threat from this vulnerability are to data integrity and system availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: code injection when using ansible_facts as a subkey",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n* Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains their own version of Ansible. The fix will be consumed from core Ansible. But we still ship ansible separately for ceph ubuntu.\n* Red Hat OpenStack Platform does package the affected code. However, because RHOSP does not use ansible_facts as a subkey directly, the RHOSP impact has been reduced to Moderate and no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10684"
},
{
"category": "external",
"summary": "RHBZ#1815519",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1815519"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10684",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10684"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10684",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10684"
}
],
"release_date": "2020-03-23T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:54+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1542"
},
{
"category": "workaround",
"details": "Currently, there is not a known mitigation except avoiding the functionality of using ansible_facts as a subkey.",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.9,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Ansible: code injection when using ansible_facts as a subkey"
},
{
"acknowledgments": [
{
"names": [
"Damien Aumaitre",
"Nicolas Surbayrole"
],
"organization": "Quarkslab"
}
],
"cve": "CVE-2020-10685",
"cwe": {
"id": "CWE-459",
"name": "Incomplete Cleanup"
},
"discovery_date": "2020-01-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1814627"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found on Ansible Engine when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the secrets unencrypted.\r\n\r\nOn Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decrypted data remains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted is sensible.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: modules which use files encrypted with vault are not properly cleaned up",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "* Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.\n\n* Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.\n\n* In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10685"
},
{
"category": "external",
"summary": "RHBZ#1814627",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814627"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10685",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10685"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10685",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10685"
}
],
"release_date": "2020-03-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:54+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1542"
},
{
"category": "workaround",
"details": "Currently, there is no mitigation for this issue except by removing manually the temporary created file after every run.",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Ansible: modules which use files encrypted with vault are not properly cleaned up"
},
{
"acknowledgments": [
{
"names": [
"Felix Fountein"
]
}
],
"cve": "CVE-2020-10691",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2020-03-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1817161"
}
],
"notes": [
{
"category": "description",
"text": "An archive traversal flaw was found in Ansible Engine when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Ansible: archive traversal vulnerability in ansible-galaxy collection install",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Ansible Engine 2.9.6 as well as previous 2.9.x versions are affected. Ansible versions less than or equal to 2.8 are not affected by this vulnerability as this functionality was introduced on 2.9.\n\nAnsible Tower 3.6.3 as well as previous 3.6.x versions are affected as they use ansible-galaxy collections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-10691"
},
{
"category": "external",
"summary": "RHBZ#1817161",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1817161"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-10691",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-10691"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10691",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10691"
}
],
"release_date": "2020-03-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2020-04-22T14:10:54+00:00",
"details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2020:1542"
},
{
"category": "workaround",
"details": "A possible mitigation of archive traversal issue could be done by restricting file access control and directory write accesses for extracting tarball files. This is feasible only for scenarios when the destination path could be known and enforced beforehand.",
"product_ids": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.noarch",
"7Server-Ansible-2:ansible-0:2.9.7-1.el7ae.src",
"7Server-Ansible-2:ansible-test-0:2.9.7-1.el7ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.noarch",
"8Base-Ansible-2:ansible-0:2.9.7-1.el8ae.src",
"8Base-Ansible-2:ansible-test-0:2.9.7-1.el8ae.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Ansible: archive traversal vulnerability in ansible-galaxy collection install"
}
]
}
gsd-2020-10691
Vulnerability from gsd
Modified
2023-12-13 01:22
Details
An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2020-10691",
"description": "An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.",
"id": "GSD-2020-10691",
"references": [
"https://www.suse.com/security/cve/CVE-2020-10691.html",
"https://access.redhat.com/errata/RHSA-2020:1542",
"https://access.redhat.com/errata/RHSA-2020:1541",
"https://access.redhat.com/errata/RHBA-2020:1540"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2020-10691"
],
"details": "An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.",
"id": "GSD-2020-10691",
"modified": "2023-12-13T01:22:04.120368Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2020-10691",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Ansible",
"version": {
"version_data": [
{
"version_value": "all ansible-engine versions 2.9.x prior to 2.9.7"
}
]
}
}
]
},
"vendor_name": "Red Hat"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "5.2/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691"
},
{
"name": "https://github.com/ansible/ansible/pull/68596",
"refsource": "CONFIRM",
"url": "https://github.com/ansible/ansible/pull/68596"
}
]
}
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003e=2.9.0,\u003c2.9.7",
"affected_versions": "All versions starting from 2.9.0 before 2.9.7",
"cvss_v2": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
"cvss_v3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"cwe_ids": [
"CWE-1035",
"CWE-22",
"CWE-937"
],
"date": "2020-05-21",
"description": "An archive traversal flaw was found in all ansible-engine, when running ansible-galaxy collection install. When extracting a collection `.tar.gz` file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.",
"fixed_versions": [
"2.9.7"
],
"identifier": "CVE-2020-10691",
"identifiers": [
"CVE-2020-10691"
],
"not_impacted": "All versions before 2.9.0, all versions starting from 2.9.7",
"package_slug": "pypi/ansible",
"pubdate": "2020-04-30",
"solution": "Upgrade to version 2.9.7 or above.",
"title": "Path Traversal",
"urls": [
"https://nvd.nist.gov/vuln/detail/CVE-2020-10691",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691"
],
"uuid": "e1b1394d-a6ee-4690-8a90-9b5f380ca242"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.9.7",
"versionStartIncluding": "2.9.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2020-10691"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691",
"refsource": "CONFIRM",
"tags": [
"Issue Tracking",
"Mitigation",
"Vendor Advisory"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691"
},
{
"name": "https://github.com/ansible/ansible/pull/68596",
"refsource": "CONFIRM",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/ansible/ansible/pull/68596"
}
]
}
},
"impact": {
"baseMetricV2": {
"acInsufInfo": false,
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 3.6,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"userInteractionRequired": false
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"exploitabilityScore": 2.0,
"impactScore": 2.7
}
},
"lastModifiedDate": "2020-05-21T14:49Z",
"publishedDate": "2020-04-30T17:15Z"
}
}
}
var-202004-0071
Vulnerability from variot
An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system. ansible-engine Exists in a past traversal vulnerability.Information is tampered with and service operation is interrupted (DoS) It may be put into a state. Ansible is a computer system configuration manager from Ansible, USA. This product can be used to publish, manage and orchestrate computer systems.
A path traversal vulnerability exists in Ansible. The vulnerability stems from the failure of network systems or products to properly filter resources or special elements in file paths. Attackers can use this vulnerability to access locations outside of the restricted directory. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Important: Ansible security and bug fix update (2.9.7) Advisory ID: RHSA-2020:1542-01 Product: Red Hat Ansible Engine Advisory URL: https://access.redhat.com/errata/RHSA-2020:1542 Issue date: 2020-04-22 CVE Names: CVE-2020-1733 CVE-2020-1735 CVE-2020-1737 CVE-2020-1739 CVE-2020-1740 CVE-2020-1746 CVE-2020-1753 CVE-2020-10684 CVE-2020-10685 CVE-2020-10691 ==================================================================== 1. Summary:
An update for ansible is now available for Ansible Engine 2
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Ansible Engine 2 for RHEL 7 - noarch Red Hat Ansible Engine 2 for RHEL 8 - noarch
- Description:
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically.
The following packages have been upgraded to a newer upstream version: ansible (2.9.7)
Bug Fix(es): * CVE-2020-10684 Ansible: code injection when using ansible_facts as a subkey * CVE-2020-10685 Ansible: modules which use files encrypted with vault are not properly cleaned up * CVE-2020-10691 Ansible: archive traversal vulnerability in ansible-galaxy collection install * CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive * CVE-2020-1735 ansible: path injection on dest parameter in fetch module * CVE-2020-1737 ansible: Extract-Zip function in win_unzip module does not check extracted path * CVE-2020-1739 ansible: svn module leaks password when specified as a parameter * CVE-2020-1740 ansible: secrets readable after ansible-vault edit * CVE-2020-1746 ansible: Information disclosure issue in ldap_attr and ldap_entry modules * CVE-2020-1753 Ansible: kubectl connection plugin leaks sensitive information
See: https://github.com/ansible/ansible/blob/v2.9.7/changelogs/CHANGELOG-v2.9.rs t for details on bug fixes in this release.
- Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
1801735 - CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive 1802085 - CVE-2020-1735 ansible: path injection on dest parameter in fetch module 1802154 - CVE-2020-1737 ansible: Extract-Zip function in win_unzip module does not check extracted path 1802178 - CVE-2020-1739 ansible: svn module leaks password when specified as a parameter 1802193 - CVE-2020-1740 ansible: secrets readable after ansible-vault edit 1805491 - CVE-2020-1746 ansible: Information disclosure issue in ldap_attr and ldap_entry modules 1811008 - CVE-2020-1753 Ansible: kubectl connection plugin leaks sensitive information 1814627 - CVE-2020-10685 Ansible: modules which use files encrypted with vault are not properly cleaned up 1815519 - CVE-2020-10684 Ansible: code injection when using ansible_facts as a subkey 1817161 - CVE-2020-10691 Ansible: archive traversal vulnerability in ansible-galaxy collection install
- Package List:
Red Hat Ansible Engine 2 for RHEL 7:
Source: ansible-2.9.7-1.el7ae.src.rpm
noarch: ansible-2.9.7-1.el7ae.noarch.rpm ansible-test-2.9.7-1.el7ae.noarch.rpm
Red Hat Ansible Engine 2 for RHEL 8:
Source: ansible-2.9.7-1.el8ae.src.rpm
noarch: ansible-2.9.7-1.el8ae.noarch.rpm ansible-test-2.9.7-1.el8ae.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2020-1733 https://access.redhat.com/security/cve/CVE-2020-1735 https://access.redhat.com/security/cve/CVE-2020-1737 https://access.redhat.com/security/cve/CVE-2020-1739 https://access.redhat.com/security/cve/CVE-2020-1740 https://access.redhat.com/security/cve/CVE-2020-1746 https://access.redhat.com/security/cve/CVE-2020-1753 https://access.redhat.com/security/cve/CVE-2020-10684 https://access.redhat.com/security/cve/CVE-2020-10685 https://access.redhat.com/security/cve/CVE-2020-10691 https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBXqBQdtzjgjWX9erEAQiAzA/+Ixc2vA1/QNQdZwcbTAoWl10xBXG2S5LL +KLCOTfHMB5e8BgGGiOnDEymEZ5SpLICs7NbHNJpZwPxEJ0SplJaVN9fy7Kg6Y4p KjWhrfaaGJL2f7tjlGSBcKhwWC5R9YQEZPSzzV4lvP4oVNT0liQLyGeDHieAG3jg mVcIaQp2yI8d3TPU35RK8XoDhOI/HqCBSrD+1V3G29PbuBkO/of6oyC/oJy5yzZr PypCWbvBiTkku2NYqqxYq94gCZypG+44+z4kYqKWSbBVEdkPJoLIA3/QDS8LE60A QnzSSV1PjKOv8AjDv4q9eH3nii3d2tfmyfr1UNVHCNCc8pEvKlx9ojb/TNB5RdYl wYcNAiUAQDRYOGmlnsPnfh/i+HGm+XccnLdlq9Kd0/HrpRaHVrgnQ4q8FCn8t2Vv JBjkrahA45gcxWRz1W4eoGGbkpnhtDc604yqT3TspqhRltHOoJjMahoZ0vi8ffv2 JjkR60dPtoWDii5Eb/wUN23DwlyCW1EsdsmZfHr355hKk5vsi+2CFMvQgW4tvG7v kCk3wvtckWXuGax543Vl1EBgBhEOt2FNlBpeG/Ge5HXvO8C77wqF1TIApK55hapI W2k5LGg1/s+iYCcpJt+fC7PatHhvmFzTkqfOZWcHnCJwVdTc9bE8yUXJ2sF9LpH/ ef20i0jkIrU=UR80 -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202004-0071",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "ansible engine",
"scope": "lt",
"trust": 1.0,
"vendor": "redhat",
"version": "2.9.7"
},
{
"model": "ansible tower",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "3.0"
},
{
"model": "ansible engine",
"scope": "gte",
"trust": 1.0,
"vendor": "redhat",
"version": "2.9.0"
},
{
"model": "ansible tower",
"scope": null,
"trust": 0.8,
"vendor": "red hat",
"version": null
},
{
"model": "ansible engine",
"scope": "eq",
"trust": 0.8,
"vendor": "red hat",
"version": "2.9.7"
},
{
"model": "ansible",
"scope": null,
"trust": 0.6,
"vendor": "ansible",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-20686"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-005055"
},
{
"db": "NVD",
"id": "CVE-2020-10691"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2.9.7",
"versionStartIncluding": "2.9.0",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-10691"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Red Hat",
"sources": [
{
"db": "PACKETSTORM",
"id": "157354"
},
{
"db": "PACKETSTORM",
"id": "157356"
},
{
"db": "CNNVD",
"id": "CNNVD-202003-1677"
}
],
"trust": 0.8
},
"cve": "CVE-2020-10691",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 3.6,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Local",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 3.6,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2020-005055",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2020-20686",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "VULMON",
"availabilityImpact": "PARTIAL",
"baseScore": 3.6,
"confidentialityImpact": "NONE",
"exploitabilityScore": 3.9,
"id": "CVE-2020-10691",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "LOW",
"trust": 0.1,
"userInteractionRequired": null,
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "NVD",
"availabilityImpact": "LOW",
"baseScore": 5.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.0,
"impactScore": 2.7,
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "Low",
"baseScore": 5.2,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "JVNDB-2020-005055",
"impactScore": null,
"integrityImpact": "Low",
"privilegesRequired": "Low",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-10691",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "secalert@redhat.com",
"id": "CVE-2020-10691",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "JVNDB-2020-005055",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2020-20686",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-202003-1677",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2020-10691",
"trust": 0.1,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-20686"
},
{
"db": "VULMON",
"id": "CVE-2020-10691"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-005055"
},
{
"db": "NVD",
"id": "CVE-2020-10691"
},
{
"db": "NVD",
"id": "CVE-2020-10691"
},
{
"db": "CNNVD",
"id": "CNNVD-202003-1677"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system. ansible-engine Exists in a past traversal vulnerability.Information is tampered with and service operation is interrupted (DoS) It may be put into a state. Ansible is a computer system configuration manager from Ansible, USA. This product can be used to publish, manage and orchestrate computer systems. \n\r\n\r\nA path traversal vulnerability exists in Ansible. The vulnerability stems from the failure of network systems or products to properly filter resources or special elements in file paths. Attackers can use this vulnerability to access locations outside of the restricted directory. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n==================================================================== \nRed Hat Security Advisory\n\nSynopsis: Important: Ansible security and bug fix update (2.9.7)\nAdvisory ID: RHSA-2020:1542-01\nProduct: Red Hat Ansible Engine\nAdvisory URL: https://access.redhat.com/errata/RHSA-2020:1542\nIssue date: 2020-04-22\nCVE Names: CVE-2020-1733 CVE-2020-1735 CVE-2020-1737\n CVE-2020-1739 CVE-2020-1740 CVE-2020-1746\n CVE-2020-1753 CVE-2020-10684 CVE-2020-10685\n CVE-2020-10691\n====================================================================\n1. Summary:\n\nAn update for ansible is now available for Ansible Engine 2\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Ansible Engine 2 for RHEL 7 - noarch\nRed Hat Ansible Engine 2 for RHEL 8 - noarch\n\n3. Description:\n\nAnsible is a simple model-driven configuration management, multi-node\ndeployment, and remote-task execution system. Ansible works over SSH and\ndoes not require any software or daemons to be installed on remote nodes. \nExtension modules can be written in any language and are transferred to\nmanaged machines automatically. \n\nThe following packages have been upgraded to a newer upstream version:\nansible (2.9.7)\n\nBug Fix(es):\n* CVE-2020-10684 Ansible: code injection when using ansible_facts as a\nsubkey\n* CVE-2020-10685 Ansible: modules which use files encrypted with vault are\nnot properly cleaned up\n* CVE-2020-10691 Ansible: archive traversal vulnerability in ansible-galaxy\ncollection install\n* CVE-2020-1733 ansible: insecure temporary directory when running\nbecome_user from become directive\n* CVE-2020-1735 ansible: path injection on dest parameter in fetch module\n* CVE-2020-1737 ansible: Extract-Zip function in win_unzip module does not\ncheck extracted path\n* CVE-2020-1739 ansible: svn module leaks password when specified as a\nparameter\n* CVE-2020-1740 ansible: secrets readable after ansible-vault edit\n* CVE-2020-1746 ansible: Information disclosure issue in ldap_attr and\nldap_entry modules\n* CVE-2020-1753 Ansible: kubectl connection plugin leaks sensitive\ninformation\n\nSee:\nhttps://github.com/ansible/ansible/blob/v2.9.7/changelogs/CHANGELOG-v2.9.rs\nt\nfor details on bug fixes in this release. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1801735 - CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive\n1802085 - CVE-2020-1735 ansible: path injection on dest parameter in fetch module\n1802154 - CVE-2020-1737 ansible: Extract-Zip function in win_unzip module does not check extracted path\n1802178 - CVE-2020-1739 ansible: svn module leaks password when specified as a parameter\n1802193 - CVE-2020-1740 ansible: secrets readable after ansible-vault edit\n1805491 - CVE-2020-1746 ansible: Information disclosure issue in ldap_attr and ldap_entry modules\n1811008 - CVE-2020-1753 Ansible: kubectl connection plugin leaks sensitive information\n1814627 - CVE-2020-10685 Ansible: modules which use files encrypted with vault are not properly cleaned up\n1815519 - CVE-2020-10684 Ansible: code injection when using ansible_facts as a subkey\n1817161 - CVE-2020-10691 Ansible: archive traversal vulnerability in ansible-galaxy collection install\n\n6. Package List:\n\nRed Hat Ansible Engine 2 for RHEL 7:\n\nSource:\nansible-2.9.7-1.el7ae.src.rpm\n\nnoarch:\nansible-2.9.7-1.el7ae.noarch.rpm\nansible-test-2.9.7-1.el7ae.noarch.rpm\n\nRed Hat Ansible Engine 2 for RHEL 8:\n\nSource:\nansible-2.9.7-1.el8ae.src.rpm\n\nnoarch:\nansible-2.9.7-1.el8ae.noarch.rpm\nansible-test-2.9.7-1.el8ae.noarch.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2020-1733\nhttps://access.redhat.com/security/cve/CVE-2020-1735\nhttps://access.redhat.com/security/cve/CVE-2020-1737\nhttps://access.redhat.com/security/cve/CVE-2020-1739\nhttps://access.redhat.com/security/cve/CVE-2020-1740\nhttps://access.redhat.com/security/cve/CVE-2020-1746\nhttps://access.redhat.com/security/cve/CVE-2020-1753\nhttps://access.redhat.com/security/cve/CVE-2020-10684\nhttps://access.redhat.com/security/cve/CVE-2020-10685\nhttps://access.redhat.com/security/cve/CVE-2020-10691\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXqBQdtzjgjWX9erEAQiAzA/+Ixc2vA1/QNQdZwcbTAoWl10xBXG2S5LL\n+KLCOTfHMB5e8BgGGiOnDEymEZ5SpLICs7NbHNJpZwPxEJ0SplJaVN9fy7Kg6Y4p\nKjWhrfaaGJL2f7tjlGSBcKhwWC5R9YQEZPSzzV4lvP4oVNT0liQLyGeDHieAG3jg\nmVcIaQp2yI8d3TPU35RK8XoDhOI/HqCBSrD+1V3G29PbuBkO/of6oyC/oJy5yzZr\nPypCWbvBiTkku2NYqqxYq94gCZypG+44+z4kYqKWSbBVEdkPJoLIA3/QDS8LE60A\nQnzSSV1PjKOv8AjDv4q9eH3nii3d2tfmyfr1UNVHCNCc8pEvKlx9ojb/TNB5RdYl\nwYcNAiUAQDRYOGmlnsPnfh/i+HGm+XccnLdlq9Kd0/HrpRaHVrgnQ4q8FCn8t2Vv\nJBjkrahA45gcxWRz1W4eoGGbkpnhtDc604yqT3TspqhRltHOoJjMahoZ0vi8ffv2\nJjkR60dPtoWDii5Eb/wUN23DwlyCW1EsdsmZfHr355hKk5vsi+2CFMvQgW4tvG7v\nkCk3wvtckWXuGax543Vl1EBgBhEOt2FNlBpeG/Ge5HXvO8C77wqF1TIApK55hapI\nW2k5LGg1/s+iYCcpJt+fC7PatHhvmFzTkqfOZWcHnCJwVdTc9bE8yUXJ2sF9LpH/\nef20i0jkIrU=UR80\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-10691"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-005055"
},
{
"db": "CNVD",
"id": "CNVD-2020-20686"
},
{
"db": "VULMON",
"id": "CVE-2020-10691"
},
{
"db": "PACKETSTORM",
"id": "157354"
},
{
"db": "PACKETSTORM",
"id": "157356"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-10691",
"trust": 3.3
},
{
"db": "JVNDB",
"id": "JVNDB-2020-005055",
"trust": 0.8
},
{
"db": "PACKETSTORM",
"id": "157356",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2020-20686",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2020.1407",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-202003-1677",
"trust": 0.6
},
{
"db": "VULMON",
"id": "CVE-2020-10691",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "157354",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-20686"
},
{
"db": "VULMON",
"id": "CVE-2020-10691"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-005055"
},
{
"db": "PACKETSTORM",
"id": "157354"
},
{
"db": "PACKETSTORM",
"id": "157356"
},
{
"db": "NVD",
"id": "CVE-2020-10691"
},
{
"db": "CNNVD",
"id": "CNNVD-202003-1677"
}
]
},
"id": "VAR-202004-0071",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-20686"
}
],
"trust": 0.06
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"IoT"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-20686"
}
]
},
"last_update_date": "2023-12-18T11:06:46.244000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "ansible-galaxy - Fix tar path traversal issue during install - CVE-2020-10691 #68596",
"trust": 0.8,
"url": "https://github.com/ansible/ansible/pull/68596"
},
{
"title": "Bug 1817161",
"trust": 0.8,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2020-10691"
},
{
"title": "Red Hat: Important: Ansible security and bug fix update (2.9.7)",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20201541 - security advisory"
},
{
"title": "Red Hat: Important: Ansible security and bug fix update (2.9.7)",
"trust": 0.1,
"url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20201542 - security advisory"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2020-10691"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-005055"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-22",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-005055"
},
{
"db": "NVD",
"id": "CVE-2020-10691"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2020-10691"
},
{
"trust": 1.7,
"url": "https://github.com/ansible/ansible/pull/68596"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-10691"
},
{
"trust": 1.4,
"url": "https://access.redhat.com/security/cve/cve-2020-10691"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-10691"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/ansible-core-write-access-via-galaxy-tar-extraction-32053"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.1407/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/157356/red-hat-security-advisory-2020-1541-01.html"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/errata/rhsa-2020:1541"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2020-1753"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2020-1740"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-1746"
},
{
"trust": 0.2,
"url": "https://github.com/ansible/ansible/blob/v2.9.7/changelogs/changelog-v2.9.rs"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-1733"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-1735"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-1737"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/articles/11258"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2020-10685"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-10684"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/team/contact/"
},
{
"trust": 0.2,
"url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2020-1737"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-10685"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-1753"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2020-1739"
},
{
"trust": 0.2,
"url": "https://bugzilla.redhat.com/):"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2020-1746"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-1739"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2020-1733"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-1740"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/team/key/"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2020-10684"
},
{
"trust": 0.2,
"url": "https://access.redhat.com/security/cve/cve-2020-1735"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/22.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://access.redhat.com/errata/rhsa-2020:1542"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-20686"
},
{
"db": "VULMON",
"id": "CVE-2020-10691"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-005055"
},
{
"db": "PACKETSTORM",
"id": "157354"
},
{
"db": "PACKETSTORM",
"id": "157356"
},
{
"db": "NVD",
"id": "CVE-2020-10691"
},
{
"db": "CNNVD",
"id": "CNNVD-202003-1677"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2020-20686"
},
{
"db": "VULMON",
"id": "CVE-2020-10691"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-005055"
},
{
"db": "PACKETSTORM",
"id": "157354"
},
{
"db": "PACKETSTORM",
"id": "157356"
},
{
"db": "NVD",
"id": "CVE-2020-10691"
},
{
"db": "CNNVD",
"id": "CNNVD-202003-1677"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-03-31T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-20686"
},
{
"date": "2020-04-30T00:00:00",
"db": "VULMON",
"id": "CVE-2020-10691"
},
{
"date": "2020-06-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-005055"
},
{
"date": "2020-04-22T15:11:55",
"db": "PACKETSTORM",
"id": "157354"
},
{
"date": "2020-04-22T15:12:11",
"db": "PACKETSTORM",
"id": "157356"
},
{
"date": "2020-04-30T17:15:11.957000",
"db": "NVD",
"id": "CVE-2020-10691"
},
{
"date": "2020-03-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202003-1677"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-02-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-20686"
},
{
"date": "2020-05-21T00:00:00",
"db": "VULMON",
"id": "CVE-2020-10691"
},
{
"date": "2020-06-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-005055"
},
{
"date": "2023-11-07T03:14:13.183000",
"db": "NVD",
"id": "CVE-2020-10691"
},
{
"date": "2020-05-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202003-1677"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202003-1677"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "ansible-engine Past Traversal Vulnerability in",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-005055"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "path traversal",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202003-1677"
}
],
"trust": 0.6
}
}
pysec-2020-2
Vulnerability from pysec
Published
2020-04-30 17:15
Modified
2020-05-21 14:49
Details
An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible",
"purl": "pkg:pypi/ansible"
},
"ranges": [
{
"events": [
{
"introduced": "2.9.0"
},
{
"fixed": "2.9.7"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.9.0",
"2.9.1",
"2.9.2",
"2.9.3",
"2.9.4",
"2.9.5",
"2.9.6"
]
}
],
"aliases": [
"CVE-2020-10691",
"GHSA-3c67-gc48-983w"
],
"details": "An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.",
"id": "PYSEC-2020-2",
"modified": "2020-05-21T14:49:00Z",
"published": "2020-04-30T17:15:00Z",
"references": [
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691"
},
{
"type": "WEB",
"url": "https://github.com/ansible/ansible/pull/68596"
},
{
"type": "ADVISORY",
"url": "https://github.com/advisories/GHSA-3c67-gc48-983w"
}
]
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.