PYSEC-2020-221
Vulnerability from pysec - Published: 2020-10-05 13:15 - Updated: 2023-06-22 16:29
VLAI?
Details
A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service availability.
Impacted products
| Name | purl | ansible | pkg:pypi/ansible |
|---|
Aliases
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "ansible",
"purl": "pkg:pypi/ansible"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0",
"1.1",
"1.2",
"1.2.1",
"1.2.2",
"1.2.3",
"1.3.0",
"1.3.1",
"1.3.2",
"1.3.3",
"1.3.4",
"1.4",
"1.4.1",
"1.4.2",
"1.4.3",
"1.4.4",
"1.4.5",
"1.5",
"1.5.1",
"1.5.2",
"1.5.3",
"1.5.4",
"1.5.5",
"1.6",
"1.6.1",
"1.6.10",
"1.6.2",
"1.6.3",
"1.6.4",
"1.6.5",
"1.6.6",
"1.6.7",
"1.6.8",
"1.6.9",
"1.7",
"1.7.1",
"1.7.2",
"1.8",
"1.8.1",
"1.8.2",
"1.8.3",
"1.8.4",
"1.9.0",
"1.9.0.1",
"1.9.1",
"1.9.2",
"1.9.3",
"1.9.4",
"1.9.5",
"1.9.6",
"2.0.0",
"2.0.0.0",
"2.0.0.1",
"2.0.0.2",
"2.0.1.0",
"2.0.2.0",
"2.1.0.0",
"2.1.1.0",
"2.1.2.0",
"2.1.3.0",
"2.1.4.0",
"2.1.5.0",
"2.1.6.0",
"2.10.0",
"2.10.0a1",
"2.10.0a2",
"2.10.0a3",
"2.10.0a4",
"2.10.0a5",
"2.10.0a6",
"2.10.0a7",
"2.10.0a8",
"2.10.0a9",
"2.10.0b1",
"2.10.0b2",
"2.10.0rc1",
"2.10.1",
"2.10.2",
"2.10.3",
"2.10.4",
"2.10.5",
"2.10.6",
"2.10.7",
"2.2.0.0",
"2.2.1.0",
"2.2.2.0",
"2.2.3.0",
"2.3.0.0",
"2.3.1.0",
"2.3.2.0",
"2.3.3.0",
"2.4.0.0",
"2.4.1.0",
"2.4.2.0",
"2.4.3.0",
"2.4.4.0",
"2.4.5.0",
"2.4.6.0",
"2.5.0",
"2.5.0a1",
"2.5.0b1",
"2.5.0b2",
"2.5.0rc1",
"2.5.0rc2",
"2.5.0rc3",
"2.5.1",
"2.5.10",
"2.5.11",
"2.5.12",
"2.5.13",
"2.5.14",
"2.5.15",
"2.5.2",
"2.5.3",
"2.5.4",
"2.5.5",
"2.5.6",
"2.5.7",
"2.5.8",
"2.5.9",
"2.6.0",
"2.6.0a1",
"2.6.0a2",
"2.6.0rc1",
"2.6.0rc2",
"2.6.0rc3",
"2.6.0rc4",
"2.6.0rc5",
"2.6.1",
"2.6.10",
"2.6.11",
"2.6.12",
"2.6.13",
"2.6.14",
"2.6.15",
"2.6.16",
"2.6.17",
"2.6.18",
"2.6.19",
"2.6.2",
"2.6.20",
"2.6.3",
"2.6.4",
"2.6.5",
"2.6.6",
"2.6.7",
"2.6.8",
"2.6.9",
"2.7.0",
"2.7.0.dev0",
"2.7.0a1",
"2.7.0b1",
"2.7.0rc1",
"2.7.0rc2",
"2.7.0rc3",
"2.7.0rc4",
"2.7.1",
"2.7.10",
"2.7.11",
"2.7.12",
"2.7.13",
"2.7.14",
"2.7.15",
"2.7.16",
"2.7.17",
"2.7.18",
"2.7.2",
"2.7.3",
"2.7.4",
"2.7.5",
"2.7.6",
"2.7.7",
"2.7.8",
"2.7.9",
"2.8.0",
"2.8.0a1",
"2.8.0b1",
"2.8.0rc1",
"2.8.0rc2",
"2.8.0rc3",
"2.8.1",
"2.8.10",
"2.8.11",
"2.8.12",
"2.8.13",
"2.8.14",
"2.8.15",
"2.8.16",
"2.8.16rc1",
"2.8.17",
"2.8.17rc1",
"2.8.18",
"2.8.18rc1",
"2.8.19",
"2.8.19rc1",
"2.8.2",
"2.8.20",
"2.8.20rc1",
"2.8.3",
"2.8.4",
"2.8.5",
"2.8.6",
"2.8.7",
"2.8.8",
"2.8.9",
"2.9.0",
"2.9.0b1",
"2.9.0rc1",
"2.9.0rc2",
"2.9.0rc3",
"2.9.0rc4",
"2.9.0rc5",
"2.9.1",
"2.9.10",
"2.9.11",
"2.9.12",
"2.9.13",
"2.9.14",
"2.9.14rc1",
"2.9.15",
"2.9.15rc1",
"2.9.16",
"2.9.16rc1",
"2.9.17",
"2.9.17rc1",
"2.9.18",
"2.9.18rc1",
"2.9.19",
"2.9.19rc1",
"2.9.2",
"2.9.20",
"2.9.20rc1",
"2.9.21",
"2.9.21rc1",
"2.9.22",
"2.9.22rc1",
"2.9.23",
"2.9.23rc1",
"2.9.24",
"2.9.24rc1",
"2.9.25",
"2.9.25rc1",
"2.9.3",
"2.9.4",
"2.9.5",
"2.9.6",
"2.9.7",
"2.9.8",
"2.9.9",
"3.0.0",
"3.0.0b1",
"3.0.0rc1",
"3.1.0",
"3.2.0",
"3.3.0",
"3.4.0",
"4.0.0",
"4.0.0a1",
"4.0.0a2",
"4.0.0a3",
"4.0.0a4",
"4.0.0b1",
"4.0.0b2",
"4.0.0rc1",
"4.1.0",
"4.2.0",
"4.3.0",
"4.4.0",
"4.5.0",
"2.9.26rc1",
"2.9.26",
"4.6.0",
"2.9.27rc1",
"5.0.0a1",
"2.9.27",
"4.7.0",
"5.0.0a2",
"4.8.0",
"5.0.0a3",
"5.0.0b1",
"5.0.0b2",
"5.0.0rc1",
"4.9.0",
"5.0.0",
"5.0.1",
"4.10.0",
"5.1.0",
"5.2.0",
"5.3.0",
"5.4.0",
"5.5.0",
"5.6.0",
"6.0.0a1",
"5.7.0",
"5.7.1",
"6.0.0a2",
"6.0.0a3",
"5.8.0",
"6.0.0b1",
"6.0.0b2",
"5.9.0",
"6.0.0rc1",
"6.0.0",
"5.10.0",
"6.1.0",
"6.2.0",
"6.3.0",
"6.4.0",
"7.0.0a1",
"6.5.0",
"7.0.0a2",
"6.6.0",
"7.0.0b1",
"6.7.0",
"7.0.0",
"7.0.0rc1",
"7.1.0",
"7.2.0",
"7.3.0",
"7.4.0",
"7.5.0",
"7.6.0",
"8.0.0",
"8.0.0a1",
"8.0.0a2",
"8.0.0a3",
"8.0.0b1",
"8.0.0rc1",
"7.7.0",
"8.1.0"
]
}
],
"aliases": [
"CVE-2020-25636"
],
"details": "A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service availability.",
"id": "PYSEC-2020-221",
"modified": "2023-06-22T16:29:43.777510Z",
"published": "2020-10-05T13:15:00Z",
"references": [
{
"type": "REPORT",
"url": "https://github.com/ansible-collections/community.aws/issues/221"
},
{
"type": "REPORT",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25636"
}
],
"withdrawn": "2023-05-30T03:49:00Z"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…