CVEvulnerability

CVE-2020-1735

4.6 MEDIUM Published 2020-03-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-03-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.2 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVSS 3.1 ([email protected])
4.6 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.6 LOW — AV:L/AC:L/Au:N/C:P/I:P/A:N
Weaknesses
CWE-22

Description

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Affected configurations

• redhat ansible (< 2.7.17) • redhat ansible (>= 2.8.0 < 2.8.11) • redhat ansible (>= 2.9.0 < 2.9.7) • redhat ansible tower (<= 3.3.4) • redhat ansible tower (>= 3.3.5 <= 3.4.5) • redhat ansible tower (>= 3.5.0 <= 3.5.5) • redhat ansible tower (>= 3.6.0 <= 3.6.3) • redhat cloudforms management engine 5.0 • redhat openstack 13 • debian debian linux 10.0 • fedoraproject fedora 30 • fedoraproject fedora 31 • fedoraproject fedora 32

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References