rhsa-2020_3602
Vulnerability from csaf_redhat
Published
2020-09-01 19:33
Modified
2024-11-15 06:14
Summary
Red Hat Security Advisory: Ansible security and bug fix update (2.9.13)

Notes

Topic
An update for ansible is now available for Ansible Engine 2 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ansible is a simple model-driven configuration management, multi-node deployment, and remote-task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. The following packages have been upgraded to a newer upstream version: ansible (2.9.13) Bug Fix(es): * CVE-2020-14365 ansible: dnf module install packages with no GPG signature See: https://github.com/ansible/ansible/blob/v2.9.13/changelogs/CHANGELOG-v2.9.rst for details on bug fixes in this release.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for ansible is now available for Ansible Engine 2\n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Ansible is a simple model-driven configuration management, multi-node\ndeployment, and remote-task execution system. Ansible works over SSH and\ndoes not require any software or daemons to be installed on remote nodes.\nExtension modules can be written in any language and are transferred to\nmanaged machines automatically.\n\nThe following packages have been upgraded to a newer upstream version:\nansible (2.9.13)\n\nBug Fix(es):\n* CVE-2020-14365 ansible: dnf module install packages with no GPG signature\n\nSee:\nhttps://github.com/ansible/ansible/blob/v2.9.13/changelogs/CHANGELOG-v2.9.rst\nfor details on bug fixes in this release.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2020:3602",
        "url": "https://access.redhat.com/errata/RHSA-2020:3602"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1869154",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3602.json"
      }
    ],
    "title": "Red Hat Security Advisory: Ansible security and bug fix update (2.9.13)",
    "tracking": {
      "current_release_date": "2024-11-15T06:14:12+00:00",
      "generator": {
        "date": "2024-11-15T06:14:12+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2020:3602",
      "initial_release_date": "2020-09-01T19:33:01+00:00",
      "revision_history": [
        {
          "date": "2020-09-01T19:33:01+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2020-09-01T19:33:01+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T06:14:12+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ansible Engine 2 for RHEL 7",
                "product": {
                  "name": "Red Hat Ansible Engine 2 for RHEL 7",
                  "product_id": "7Server-Ansible-2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_engine:2::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Ansible Engine 2 for RHEL 8",
                "product": {
                  "name": "Red Hat Ansible Engine 2 for RHEL 8",
                  "product_id": "8Base-Ansible-2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_engine:2::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ansible Engine"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-0:2.9.13-1.el7ae.noarch",
                "product": {
                  "name": "ansible-0:2.9.13-1.el7ae.noarch",
                  "product_id": "ansible-0:2.9.13-1.el7ae.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible@2.9.13-1.el7ae?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-test-0:2.9.13-1.el7ae.noarch",
                "product": {
                  "name": "ansible-test-0:2.9.13-1.el7ae.noarch",
                  "product_id": "ansible-test-0:2.9.13-1.el7ae.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-test@2.9.13-1.el7ae?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-0:2.9.13-1.el8ae.noarch",
                "product": {
                  "name": "ansible-0:2.9.13-1.el8ae.noarch",
                  "product_id": "ansible-0:2.9.13-1.el8ae.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible@2.9.13-1.el8ae?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-test-0:2.9.13-1.el8ae.noarch",
                "product": {
                  "name": "ansible-test-0:2.9.13-1.el8ae.noarch",
                  "product_id": "ansible-test-0:2.9.13-1.el8ae.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-test@2.9.13-1.el8ae?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-0:2.9.13-1.el7ae.src",
                "product": {
                  "name": "ansible-0:2.9.13-1.el7ae.src",
                  "product_id": "ansible-0:2.9.13-1.el7ae.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible@2.9.13-1.el7ae?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-0:2.9.13-1.el8ae.src",
                "product": {
                  "name": "ansible-0:2.9.13-1.el8ae.src",
                  "product_id": "ansible-0:2.9.13-1.el8ae.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible@2.9.13-1.el8ae?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-0:2.9.13-1.el7ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7",
          "product_id": "7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.noarch"
        },
        "product_reference": "ansible-0:2.9.13-1.el7ae.noarch",
        "relates_to_product_reference": "7Server-Ansible-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-0:2.9.13-1.el7ae.src as a component of Red Hat Ansible Engine 2 for RHEL 7",
          "product_id": "7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.src"
        },
        "product_reference": "ansible-0:2.9.13-1.el7ae.src",
        "relates_to_product_reference": "7Server-Ansible-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-test-0:2.9.13-1.el7ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 7",
          "product_id": "7Server-Ansible-2:ansible-test-0:2.9.13-1.el7ae.noarch"
        },
        "product_reference": "ansible-test-0:2.9.13-1.el7ae.noarch",
        "relates_to_product_reference": "7Server-Ansible-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-0:2.9.13-1.el8ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 8",
          "product_id": "8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.noarch"
        },
        "product_reference": "ansible-0:2.9.13-1.el8ae.noarch",
        "relates_to_product_reference": "8Base-Ansible-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-0:2.9.13-1.el8ae.src as a component of Red Hat Ansible Engine 2 for RHEL 8",
          "product_id": "8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.src"
        },
        "product_reference": "ansible-0:2.9.13-1.el8ae.src",
        "relates_to_product_reference": "8Base-Ansible-2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-test-0:2.9.13-1.el8ae.noarch as a component of Red Hat Ansible Engine 2 for RHEL 8",
          "product_id": "8Base-Ansible-2:ansible-test-0:2.9.13-1.el8ae.noarch"
        },
        "product_reference": "ansible-test-0:2.9.13-1.el8ae.noarch",
        "relates_to_product_reference": "8Base-Ansible-2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Bruno Travouillon"
          ],
          "organization": "Atos"
        }
      ],
      "cve": "CVE-2020-14365",
      "cwe": {
        "id": "CWE-347",
        "name": "Improper Verification of Cryptographic Signature"
      },
      "discovery_date": "2020-08-08T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1869154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Ansible Engine when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ansible: dnf module install packages with no GPG signature",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Ansible Engine 2.8.14 and 2.9.12 as well as previous versions versions are affected.\n\nAnsible Tower 3.7.2 and 3.6.5 as well as previous versions are affected for containerized versions and has been fixed indirectly in the 3.6.6 and 3.7.3 releases. For non-containerized Ansible Tower versions, the fix is provided via yum update or yum install.\n\nRed Hat Gluster Storage(RHGS) 3, Red Hat Ceph Storage (RHCS) 2 and 3 ships the affected version of ansible, but they no longer maintain their own version of ansible. Both the products will consume fixes directly from ansible repository. As RHCS 2 and 3 do not use dnf, impact rating is reduced to Low. RHCS still ship ansible separately for Ceph on Ubuntu, but Ubuntu is not impacted by this vulnerability as it uses apt instead of dnf.\n\nRed Hat OpenStack Platform 10 and 13 ship a vulnerable version of Ansible, however installation of packages is done via yum instead of dnf so this flaw will have no effect.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.noarch",
          "7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.src",
          "7Server-Ansible-2:ansible-test-0:2.9.13-1.el7ae.noarch",
          "8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.noarch",
          "8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.src",
          "8Base-Ansible-2:ansible-test-0:2.9.13-1.el8ae.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-14365"
        },
        {
          "category": "external",
          "summary": "RHBZ#1869154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14365",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-14365"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14365",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14365"
        }
      ],
      "release_date": "2020-08-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-09-01T19:33:01+00:00",
          "details": "For details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.noarch",
            "7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.src",
            "7Server-Ansible-2:ansible-test-0:2.9.13-1.el7ae.noarch",
            "8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.noarch",
            "8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.src",
            "8Base-Ansible-2:ansible-test-0:2.9.13-1.el8ae.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:3602"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.",
          "product_ids": [
            "7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.noarch",
            "7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.src",
            "7Server-Ansible-2:ansible-test-0:2.9.13-1.el7ae.noarch",
            "8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.noarch",
            "8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.src",
            "8Base-Ansible-2:ansible-test-0:2.9.13-1.el8ae.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.noarch",
            "7Server-Ansible-2:ansible-0:2.9.13-1.el7ae.src",
            "7Server-Ansible-2:ansible-test-0:2.9.13-1.el7ae.noarch",
            "8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.noarch",
            "8Base-Ansible-2:ansible-0:2.9.13-1.el8ae.src",
            "8Base-Ansible-2:ansible-test-0:2.9.13-1.el8ae.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ansible: dnf module install packages with no GPG signature"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.