GHSA-f85h-23mf-2fwh

Argument Injection in Ansible

Source: GitHub Advisory Database (reviewed) Low CVE-2020-1738

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ansible	<= 2.7.16	no fix listed
PyPI	ansible	>= 2.8.0a1, <= 2.8.10	no fix listed
PyPI	ansible	>= 2.9.0a1, <= 2.9.6	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-1738 advisory
https://github.com/ansible/ansible/issues/67796 web
https://github.com/ansible/ansible/pull/67808 web
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738 web
https://github.com/advisories/GHSA-f85h-23mf-2fwh advisory
https://github.com/ansible/ansible package
https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-10.yaml web
https://security.gentoo.org/glsa/202006-11 web