PT-2020-16143 · Ansible · Ansible Base+1

Abeluck · Published 2020-10-05 · Updated 2020-10-09 · CVE-2020-25636

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ansible Base (affected versions not specified)

Description A flaw was found in Ansible Base when using the aws ssm connection plugin, as there is no namespace separation for file transfers. Files are written directly to the root bucket, making it possible to have collisions when running multiple Ansible processes. This issue affects mainly the service availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Files Accessible to External Parties

Weakness Enumeration

CWE-552

CWE-377

Related Identifiers

CVE-2020-25636

PYSEC-2020-221

Affected Products

Ansible Base

Ansible-Core

References · 9

• https://osv.dev/vulnerability/CVE-2020-25636 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25636 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-25636 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25636 · Security Note
• https://osv.dev/vulnerability/PYSEC-2020-221 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25636 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25636 · Security Note
• https://github.com/ansible-collections/community.aws/issues/221 · Note
• https://t.me/cibsecurity/15046 · Telegram Post