CVE-2020-1733

ansible: insecure temporary directory when running become_user from become directive

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat

Products

Debian Linux Fedora Ansible and 4 more

CVE-2020-15366

nodejs-ajv: prototype pollution via crafted JSON schema in ajv.validate function

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

CVSS 3.1 · 5.6 Medium EPSS 2.3% KEV · Not listed

Vendors

Ajv.js Redhat

Products

Ajv Ansible Automation Platform Enterprise Linux and 3 more

CVE-2020-14365

ansible: dnf module install packages with no GPG signature

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Debian Redhat

Products

Debian Linux Ansible Engine Ansible Tower and 2 more

CVE-2020-14337

Tower: Named URLs allow for testing the presence or absence of objects

A data exposure flaw was found in Tower, where sensitive data was revealed from the HTTP return error codes. This flaw allows an unauthenticated, remote attacker to retrieve pages from the default organization and verify existing usernames. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5.8 Medium EPSS 1.5% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2020-14332

Ansible: module_args does not censor properly in --check mode

A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Redhat

Products

Debian Linux Ansible Engine

CVE-2020-14330

Ansible: masked keys for uri module are exposed into content and json output

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Redhat

Products

Debian Linux Ansible Engine

CVE-2020-14329

Tower: Sensitive Data Exposure on Label

A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpoint. This flaw allows users from other organizations in the system to retrieve any label from the organization and also disclose organization names. The highest threat from this vulnerability is to confidentiality.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2020-14328

Tower: SSRF: Server Side Request Forgery on webhooks

A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could lead to the server processing it connecting to internal services or exposing additional internal services and more particularly retrieving full details in case of error. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2020-14327

Tower: SSRF: Server Side Request Forgery on Credential

A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower server is abused by supplying a URL that could lead to the server processing it. This flaw leads to the connection to internal services or the exposure of additional internal services by abusing the test feature of lookup credentials to forge HTTP/HTTPS requests from the server and retrieving the results of the response.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2020-10782

Tower: rsyslog configuration has world readable permissions

An exposure of sensitive information flaw was found in Ansible version 3.7.0. Sensitive information, such tokens and other secrets could be readable and exposed from the rsyslog configuration file, which has set the wrong world-readable permissions. The highest threat from this vulnerability is to confidentiality. This is fixed in Ansible version 3.7.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2020-10744

ansible: incomplete fix for CVE-2020-1733

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Ansible Tower

CVE-2020-10729

Ansible: two random password lookups in same task return same value

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Redhat

Products

Debian Linux Ansible Engine Ansible Tower and 1 more

CVE-2020-10709

Tower: OAuth2 refresh tokens do not respect the expiration

A security flaw was found in Ansible Tower when requesting an OAuth2 token with an OAuth2 application. Ansible Tower uses the token to provide authentication. This flaw allows an attacker to obtain a refresh token that does not expire. The original token granted to the user still has access to Ansible Tower, which allows any user that can gain access to the token to be fully authenticated to Ansible Tower. This flaw affects Ansible Tower versions before 3.6.4 and Ansible Tower versions before 3.5.6.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2020-10698

Tower: normal users can intercept stdout from jobs running in other organizations

A flaw was found in Ansible Tower when running jobs. This flaw allows an attacker to access the stdout of the executed jobs which are run from other organizations. Some sensible data can be disclosed. However, critical data should not be disclosed, as it should be protected by the no_log flag when debugging is enabled. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2020-10697

Tower: memcached deployment is insecure on OpenShift

A flaw was found in Ansible Tower when running Openshift. Tower runs a memcached, which is accessed via TCP. An attacker can take advantage of writing a playbook polluting this cache, causing a denial of service attack. This attack would not completely stop the service, but in the worst-case scenario, it can reduce the Tower performance, for which memcached is designed. Theoretically, more sophisticated attacks can be performed by manipulating and crafting the cache, as Tower relies on memcached as a place to pull out setting values. Confidential and sensitive data stored in memcached should not be pulled, as this information is encrypted. This flaw affects Ansible Tower versions before 3.6.4, Ansible Tower versions before 3.5.6 and Ansible Tower versions before 3.4.6.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Tower

CVE-2020-10691

Ansible: archive traversal vulnerability in ansible-galaxy collection install

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Engine Ansible Tower

CVE-2020-10685

Ansible: modules which use files encrypted with vault are not properly cleaned up

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Redhat

Products

Debian Linux Ansible Engine Ansible Tower and 3 more

CVE-2020-10684

Ansible: code injection when using ansible_facts as a subkey

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.

CVSS 3.1 · 7.9 High EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat

Products

Debian Linux Fedora Ansible and 3 more

CVE-2019-9924

bash: BASH_CMD is writable in restricted bash shells

rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Gnu and 3 more

Products

Ubuntu Linux Debian Linux Bash and 9 more

CVE-2019-7665

elfutils: heap-based buffer over-read in function elf32_xlatetom in elf32_xlatetom.c

In elfutils 0.175, a heap-based buffer over-read was discovered in the function elf32_xlatetom in elf32_xlatetom.c in libelf. A crafted ELF input can cause a segmentation fault leading to denial of service (program crash) because ebl_core_note does not reject malformed core file notes.

CVSS 3.1 · 5.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Canonical Debian Elfutils Project and 2 more

Products

Ubuntu Linux Debian Linux Elfutils and 9 more