Vulnerability in Red Hat Ansible
CVE-2020-1738
A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
EPSS: 0.004 (30.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 3.9 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L.
Affected products
- Red Hat Ansible — versions 2.7.x, 2.8.x, 2.9.x
- Redhat Ansible
- Redhat Ansible_tower
- Redhat Cloudforms_management_engine — versions 5.0
- Redhat Openstack — versions 13
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory)
- secalert@redhat.com (vendor-advisory, x_refsource_GENTOO)
Frequently asked questions
- What is CVE-2020-1738?
- CVE-2020-1738 is a low-severity vulnerability in Red Hat Ansible, classified under Argument Injection. CVSS score: 3.9/10. Published 2020-03-16.
- How severe is CVE-2020-1738?
- Low severity. CVSS v3 base score is 3.9 out of 10.