~ / search / GHSA-p62g-jhg6-v3rq

GHSA-p62g-jhg6-v3rq

Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-10684

Packages

EcosystemPackageAffectedFixed in
PyPI ansible >= 2.7.0a1, < 2.7.17 2.7.17
PyPI ansible >= 2.8.0a1, < 2.8.11 2.8.11
PyPI ansible >= 2.9.0a1, < 2.9.7 2.9.7

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.11, and 2.9.7 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.

References

External links from the advisory. They lead to third-party sites.