GitHub Advisoryadvisory · PyPI

GHSA-h39q-95q5-9jfp OS Command Injection in ansible

HIGH Published 2022-02-09 Modified 2024-09-10 Official page ↗
Aliases
CVE-2020-1734
Ecosystem
PyPI
Packages
ansible
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L
Weaknesses
CWE-78
Reviewed
2021-04-02

Affected packages

• PyPI ansible: >= 2.10.0a1, < 2.10.0rc1 → fixed in 2.10.0rc1 • PyPI ansible: >= 2.9.0a1, < 2.9.11 → fixed in 2.9.11 • PyPI ansible: < 2.8.13 → fixed in 2.8.13

Description

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses `subprocess.Popen()` with `shell=True`, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.

Related

Alias · CVE (1)

  • CVE-2020-1734 A flaw was found in the pipe lookup plugin of ansible. vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References