pysec-2020-207
Vulnerability from pysec
Published
2020-03-24 14:15
Modified
2021-07-02 02:41
Details
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
Aliases
{ "affected": [ { "package": { "ecosystem": "PyPI", "name": "ansible", "purl": "pkg:pypi/ansible" }, "ranges": [ { "events": [ { "introduced": "2.7.0" }, { "fixed": "2.7.17" }, { "introduced": "2.8.0" }, { "fixed": "2.8.9" }, { "introduced": "2.9.0" }, { "fixed": "2.9.6" } ], "type": "ECOSYSTEM" } ], "versions": [ "2.7.0", "2.7.1", "2.7.10", "2.7.11", "2.7.12", "2.7.13", "2.7.14", "2.7.15", "2.7.16", "2.7.2", "2.7.3", "2.7.4", "2.7.5", "2.7.6", "2.7.7", "2.7.8", "2.7.9", "2.8.0", "2.8.1", "2.8.2", "2.8.3", "2.8.4", "2.8.5", "2.8.6", "2.8.7", "2.8.8", "2.9.0", "2.9.1", "2.9.2", "2.9.3", "2.9.4", "2.9.5" ] } ], "aliases": [ "CVE-2020-10684", "GHSA-p62g-jhg6-v3rq" ], "details": "A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.", "id": "PYSEC-2020-207", "modified": "2021-07-02T02:41:34.761872Z", "published": "2020-03-24T14:15:00Z", "references": [ { "type": "REPORT", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10684" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/" }, { "type": "WEB", "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/" }, { "type": "ADVISORY", "url": "https://security.gentoo.org/glsa/202006-11" }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-p62g-jhg6-v3rq" } ] }
Loading...
Loading...
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.