PT-2020-6581 · Red Hat+5 · Ansible+5
Samdoran
·
Published
2020-03-12
·
Updated
2026-06-03
·
CVE-2020-1739
CVSS v3.1
3.9
Low
| Vector | AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Ansible versions 2.7.16 and prior
Ansible versions 2.8.8 and prior
Ansible versions 2.9.5 and prior
Description
A flaw was found in Ansible when a password is set with the argument
password of the svn module, it is used on the svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs. The vulnerability is related to information disclosure and could allow an attacker to access confidential data and compromise its integrity.Recommendations
For Ansible versions 2.7.16 and prior, consider disabling the
password argument of the svn module until a patch is available.
For Ansible versions 2.8.8 and prior, restrict access to the svn module to minimize the risk of exploitation.
For Ansible versions 2.9.5 and prior, avoid using the password argument in the svn module until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Ansible
Ansible-Core
Astra Linux
Linuxmint
Ubuntu