CVEvulnerability

CVE-2020-10684

7.1 HIGH Published 2020-03-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-03-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.9 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
CVSS 3.1 ([email protected])
7.1 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0 ([email protected])
3.6 LOW — AV:L/AC:L/Au:N/C:N/I:P/A:P
Weaknesses
CWE-362, CWE-862, CWE-94

Description

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.

Affected configurations

• redhat ansible (>= 2.7.0 < 2.7.17) • redhat ansible (>= 2.8.0 < 2.8.9) • redhat ansible (>= 2.9.0 < 2.9.6) • redhat ansible tower (<= 3.3.5) • redhat ansible tower (>= 3.5.0 <= 3.5.5) • redhat ansible tower (>= 3.6.0 <= 3.6.3) • redhat openstack 10 • redhat openstack 13 • debian debian linux 10.0 • fedoraproject fedora 30 • fedoraproject fedora 31 • fedoraproject fedora 32

Related

Weakness · CWE (3)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-862 Missing Authorization weakness
  • CWE-94 Improper Control of Generation of Code weakness

References