rhsa-2020_3600
Vulnerability from csaf_redhat
Published
2020-09-01 19:32
Modified
2024-11-05 22:41
Summary
Red Hat Security Advisory: Ansible security and bug fix update (2.8.15)

Notes

Topic
An update for ansible is now available for Ansible Engine 2.8 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. The following packages have been upgraded to a newer upstream version: ansible (2.8.15) Bug Fix(es): * CVE-2020-14365 ansible: dnf module install packages with no GPG signature See: https://github.com/ansible/ansible/blob/v2.8.15/changelogs/CHANGELOG-v2.8.rst for details on bug fixes in this release.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for ansible is now available for Ansible Engine 2.8\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Ansible is a simple model-driven configuration management, multi-node\ndeployment, and remote-task execution system. Ansible works over SSH and\ndoes not require any software or daemons to be installed on remote nodes.\nExtension modules can be written in any language and are transferred to\nmanaged machines automatically.\n\nThe following packages have been upgraded to a newer upstream version:\nansible (2.8.15)\n\nBug Fix(es):\n* CVE-2020-14365 ansible: dnf module install packages with no GPG signature\n\nSee:\nhttps://github.com/ansible/ansible/blob/v2.8.15/changelogs/CHANGELOG-v2.8.rst\nfor details on bug fixes in this release.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2020:3600",
        "url": "https://access.redhat.com/errata/RHSA-2020:3600"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1869154",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3600.json"
      }
    ],
    "title": "Red Hat Security Advisory: Ansible security and bug fix update (2.8.15)",
    "tracking": {
      "current_release_date": "2024-11-05T22:41:13+00:00",
      "generator": {
        "date": "2024-11-05T22:41:13+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2020:3600",
      "initial_release_date": "2020-09-01T19:32:43+00:00",
      "revision_history": [
        {
          "date": "2020-09-01T19:32:43+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2020-09-01T19:32:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T22:41:13+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ansible Engine 2.8 for RHEL 7 Server",
                "product": {
                  "name": "Red Hat Ansible Engine 2.8 for RHEL 7 Server",
                  "product_id": "7Server-Ansible-2.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_engine:2.8::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Ansible Engine 2.8 for RHEL 8",
                "product": {
                  "name": "Red Hat Ansible Engine 2.8 for RHEL 8",
                  "product_id": "8Base-Ansible-2.8",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_engine:2.8::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ansible Engine"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-0:2.8.15-1.el7ae.noarch",
                "product": {
                  "name": "ansible-0:2.8.15-1.el7ae.noarch",
                  "product_id": "ansible-0:2.8.15-1.el7ae.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible@2.8.15-1.el7ae?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-0:2.8.15-1.el8ae.noarch",
                "product": {
                  "name": "ansible-0:2.8.15-1.el8ae.noarch",
                  "product_id": "ansible-0:2.8.15-1.el8ae.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible@2.8.15-1.el8ae?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-0:2.8.15-1.el7ae.src",
                "product": {
                  "name": "ansible-0:2.8.15-1.el7ae.src",
                  "product_id": "ansible-0:2.8.15-1.el7ae.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible@2.8.15-1.el7ae?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-0:2.8.15-1.el8ae.src",
                "product": {
                  "name": "ansible-0:2.8.15-1.el8ae.src",
                  "product_id": "ansible-0:2.8.15-1.el8ae.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible@2.8.15-1.el8ae?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-0:2.8.15-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.8 for RHEL 7 Server",
          "product_id": "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch"
        },
        "product_reference": "ansible-0:2.8.15-1.el7ae.noarch",
        "relates_to_product_reference": "7Server-Ansible-2.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-0:2.8.15-1.el7ae.src as a component of Red Hat Ansible Engine 2.8 for RHEL 7 Server",
          "product_id": "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src"
        },
        "product_reference": "ansible-0:2.8.15-1.el7ae.src",
        "relates_to_product_reference": "7Server-Ansible-2.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-0:2.8.15-1.el8ae.noarch as a component of Red Hat Ansible Engine 2.8 for RHEL 8",
          "product_id": "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch"
        },
        "product_reference": "ansible-0:2.8.15-1.el8ae.noarch",
        "relates_to_product_reference": "8Base-Ansible-2.8"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-0:2.8.15-1.el8ae.src as a component of Red Hat Ansible Engine 2.8 for RHEL 8",
          "product_id": "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
        },
        "product_reference": "ansible-0:2.8.15-1.el8ae.src",
        "relates_to_product_reference": "8Base-Ansible-2.8"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Damien Aumaitre",
            "Nicolas Surbayrole"
          ],
          "organization": "Quarkslab"
        }
      ],
      "cve": "CVE-2020-1736",
      "cwe": {
        "id": "CWE-732",
        "name": "Incorrect Permission Assignment for Critical Resource"
      },
      "discovery_date": "2020-01-21T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1802124"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move.  This issue affects only the newly created files and not existing ones. If the file already exists at the final destination, those permissions are retained. This could lead to the disclosure of sensitive data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ansible: atomic_move primitive sets permissive permissions",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Ansible Engine 2.8.14 and 2.9.12 as well as previous versions and all 2.7.x versions are affected.\n\nAnsible Tower 3.6.5 and 3.7.2 as well as previous versions are affected.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact,  ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
          "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
          "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
          "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-1736"
        },
        {
          "category": "external",
          "summary": "RHBZ#1802124",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802124"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1736",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-1736"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1736",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1736"
        }
      ],
      "release_date": "2020-02-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-09-01T19:32:43+00:00",
          "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:3600"
        },
        {
          "category": "workaround",
          "details": "This issue can be mitigated by specifying the \"mode\" on the task. That just leaves a race condition in place where newly created files that specify a mode in the task briefly go from 666 - umask to the final mode. An alternative workaround if many new files are created and to avoid setting a specific mode for each file would be to set the \"mode\" to \"preserve\" value. That will maintain the permissions of the source file on the controller in the final file on the managed host.",
          "product_ids": [
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 2.2,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Low"
        }
      ],
      "title": "ansible: atomic_move primitive sets permissive permissions"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Hung Luong"
          ]
        }
      ],
      "cve": "CVE-2020-14330",
      "cwe": {
        "id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      },
      "discovery_date": "2020-07-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1856815"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Ansible: masked keys for uri module are exposed into content and json output",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Ansible Engine 2.9.12 (downstream) and Ansible Engine 2.9.11 (upstream), as well as previous versions are affected by this flaw. Ansible Engine 2.9.12 version (upstream) on towards fixes the issue for upstream and Red Hat Ansible Engine 2.9.13 version is fixed (downstream).\n\nRed Hat Gluster Storage 3 and Red Hat Ceph Storage 3 ships the affected version of Ansible, but they no longer maintain their own version of Ansible. Both the products will consume fixes directly from the Ansible repository. As we still ship Ansible separately for Ceph on Ubuntu, a future update may address this issue.\n\nIn Red Hat OpenStack Platform, because ansible is not directly customer exposed (so that the flaw could not be exploited) and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package. Note: Red Hat Open Stack Platform 15 and newer consume fixes directly from the Ansible repository.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
          "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
          "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
          "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-14330"
        },
        {
          "category": "external",
          "summary": "RHBZ#1856815",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856815"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14330",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-14330"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14330",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14330"
        },
        {
          "category": "external",
          "summary": "https://github.com/ansible/ansible/issues/68400",
          "url": "https://github.com/ansible/ansible/issues/68400"
        }
      ],
      "release_date": "2020-03-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-09-01T19:32:43+00:00",
          "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:3600"
        },
        {
          "category": "workaround",
          "details": "There is no mitigation for this issue.",
          "product_ids": [
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Ansible: masked keys for uri module are exposed into content and json output"
    },
    {
      "cve": "CVE-2020-14332",
      "cwe": {
        "id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      },
      "discovery_date": "2020-07-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1857805"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Ansible: module_args does not censor properly in --check mode",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The version of ansible provided in Red Hat Gluster Storage 3, Red Hat Ceph Storage 2 and 3 does not contain the vulnerable functionality and is not affected by this vulnerability. Additionally, these storage products no longer maintains their own version of ansible and fixes are consumed from core Ansible repository.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
          "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
          "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
          "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-14332"
        },
        {
          "category": "external",
          "summary": "RHBZ#1857805",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857805"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14332",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-14332"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14332",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14332"
        },
        {
          "category": "external",
          "summary": "https://github.com/ansible/ansible/pull/71033",
          "url": "https://github.com/ansible/ansible/pull/71033"
        }
      ],
      "release_date": "2020-07-16T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-09-01T19:32:43+00:00",
          "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:3600"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Ansible: module_args does not censor properly in --check mode"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Bruno Travouillon"
          ],
          "organization": "Atos"
        }
      ],
      "cve": "CVE-2020-14365",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2020-08-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1869154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Ansible Engine when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ansible: dnf module install packages with no GPG signature",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Ansible Engine 2.8.14 and 2.9.12 as well as previous versions versions are affected.\n\nAnsible Tower 3.7.2 and 3.6.5 as well as previous versions are affected for containerized versions and has been fixed indirectly in the 3.6.6 and 3.7.3 releases. For non-containerized Ansible Tower versions, the fix is provided via yum update or yum install.\n\nRed Hat Gluster Storage(RHGS) 3, Red Hat Ceph Storage (RHCS) 2 and 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository. As RHCS 2 and 3 do not use dnf, impact rating is reduced to Low. RHCS still ship ansible separately for Ceph on Ubuntu, but Ubuntu is not impacted by this vulnerability as it uses apt instead of dnf.\n\nRed Hat OpenStack Platform 10 and 13 ship a vulnerable version of Ansible, however installation of packages is done via yum instead of dnf so this flaw will have no effect.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
          "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
          "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
          "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-14365"
        },
        {
          "category": "external",
          "summary": "RHBZ#1869154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14365",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-14365"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14365",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14365"
        }
      ],
      "release_date": "2020-08-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-09-01T19:32:43+00:00",
          "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:3600"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.",
          "product_ids": [
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.noarch",
            "7Server-Ansible-2.8:ansible-0:2.8.15-1.el7ae.src",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.noarch",
            "8Base-Ansible-2.8:ansible-0:2.8.15-1.el8ae.src"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ansible: dnf module install packages with no GPG signature"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.