Ansible Automation Platform CVEs and Security Vulnerabilities

CVE-2020-7789

Command Injection

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

CVSS 3.1 · 5.6 Medium EPSS 1.6% KEV · Not listed

Vendors

Node-notifier Project Redhat

Products

Node-notifier Ansible Automation Platform

CVE-2020-35678

python-autobahn: allows redirect header injection

Autobahn|Python before 20.12.3 allows redirect header injection.

CVSS 3.1 · 6.1 Medium EPSS 1.4% KEV · Not listed

Vendors

Crossbar Redhat

Products

Autobahn Ansible Automation Platform Ansible Tower

CVE-2020-15366

nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

CVSS 3.1 · 5.6 Medium EPSS 2.3% KEV · Not listed

Vendors

Ajv.js Redhat

Products

Ajv Ansible Automation Platform Enterprise Linux and 3 more

Search vulnerabilities

Command Injection

python-autobahn: allows redirect header injection

nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function