PT-2020-5206 · Red Hat+3 · Ansible Engine+3
Damien Aumaitre
+1
·
Published
2020-03-12
·
Updated
2026-06-03
·
CVE-2020-10684
CVSS v3.1
7.9
High
| Vector | AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Ansible Engine versions 2.7.x through 2.7.17
Ansible Engine versions 2.8.x through 2.8.9
Ansible Engine versions 2.9.x through 2.9.6
Description
A flaw was found in Ansible Engine when using
ansible facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible facts after the clean. An attacker could take advantage of this by altering the ansible facts, such as ansible hosts, users, and any other key data, which would lead to privilege escalation or code injection.Recommendations
For Ansible Engine versions 2.7.x through 2.7.17, update to version 2.7.17 or later.
For Ansible Engine versions 2.8.x through 2.8.9, update to version 2.8.9 or later.
For Ansible Engine versions 2.9.x through 2.9.6, update to version 2.9.6 or later.
As a temporary workaround, consider disabling the use of
ansible facts as a subkey of itself when inject is enabled to minimize the risk of exploitation.Fix
Race Condition
Missing Authorization
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Ansible-Core
Ansible Engine
Astra Linux