PT-2020-5969 · Red Hat+1 · Ansible+2

Borja Tarraso · Published 2020-06-18 · Updated 2021-10-26 · CVE-2020-10782

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ansible version 3.7.0 Ansible Tower versions prior to 3.7.1

Description A flaw in the rsyslog configuration file was found, causing sensitive information such as tokens and secrets to be exposed due to incorrect world-readable permissions. This issue poses a significant threat to confidentiality.

Recommendations For Ansible version 3.7.0, update to version 3.7.1 to resolve the issue. For Ansible Tower versions prior to 3.7.1, update to version 3.7.1 or later to fix the problem.

Fix

Incorrect Permission

Information Disclosure

Incorrect Default Permissions

Weakness Enumeration

CWE-732

CWE-200

CWE-276

Related Identifiers

BDU:2021-02145

CVE-2020-10782

Affected Products

Ansible

Ansible Tower

Rsyslog

References · 6

• https://osv.dev/vulnerability/CVE-2020-10782 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10782 · Security Note
• https://bdu.fstec.ru/vul/2021-02145 · Security Note
• https://access.redhat.com/security/cve/cve-2020-10782 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10782 · Note
• https://t.me/cvenotify/4462 · Telegram Post