NetSight
IP …
high7.9

CVE-2020-10684

Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible

Impact

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.11, and 2.9.7 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.

Affected packages

EcosystemPackageAffectedFixed in
pipansible>= 2.7.0a1, < 2.7.172.7.17

Affected products

VendorProductAffected versions
RedhatAnsible
from 2.7.0 before 2.7.17
from 2.8.0 before 2.8.9
from 2.9.0 before 2.9.6
RedhatAnsible Tower
through 3.3.5
from 3.5.0 through 3.5.5
from 3.6.0 through 3.6.3
RedhatOpenstack
Versions 10, 13
DebianDebian Linux
Version 10.0
FedoraprojectFedora
Versions 30, 31, 32

Weakness classification

CWE-94CWE-362CWE-862CWE-250

References