CVE-2020-1735
EUVD-2020-002916.03.2020, 16:15
A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| redhat | ansible | 𝑥 < 2.7.17 |
| redhat | ansible | 2.8.0 ≤ 𝑥 < 2.8.11 |
| redhat | ansible | 2.9.0 ≤ 𝑥 < 2.9.7 |
| redhat | ansible_tower | 𝑥 ≤ 3.3.4 |
| redhat | ansible_tower | 3.3.5 ≤ 𝑥 ≤ 3.4.5 |
| redhat | ansible_tower | 3.5.0 ≤ 𝑥 ≤ 3.5.5 |
| redhat | ansible_tower | 3.6.0 ≤ 𝑥 ≤ 3.6.3 |
| redhat | cloudforms_management_engine | 5.0 |
| debian | debian_linux | 10.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References