CVE-2020-1738
16.03.2020, 16:15
A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
| Vendor | Product | Version |
|---|---|---|
| redhat | ansible | 𝑥 ≤ 2.7.16 |
| redhat | ansible | 2.8.0 ≤ 𝑥 ≤ 2.8.8 |
| redhat | ansible | 2.9.0 ≤ 𝑥 ≤ 2.9.5 |
| redhat | ansible_tower | 𝑥 ≤ 3.3.4 |
| redhat | ansible_tower | 3.3.5 ≤ 𝑥 ≤ 3.4.5 |
| redhat | ansible_tower | 3.5.0 ≤ 𝑥 ≤ 3.5.5 |
| redhat | ansible_tower | 3.6.0 ≤ 𝑥 ≤ 3.6.3 |
| redhat | cloudforms_management_engine | 5.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
References