⚠ Exploited in the wild
Exploitation observed in the wild. Not yet on CISA KEV.
CVE-2020-10684 — Code Injection in Redhat Ansible
Severity
7.1HIGHNVD
CNA7.9VulnCheck7.9
EPSS
0.0%
top 93.54%
CISA KEV
Not in KEV
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedMar 24
Latest updateApr 7
Description
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HExploitability: 1.8 | Impact: 5.2
Affected Packages6 packages
▶CVEListV5red_hat/ansibleall Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.9, all Ansible 2.9.x versions prior to 2.9.6+2
Also affects: Debian Linux 10.0, Fedora 30, 31, 32
🔴Vulnerability Details
5GHSA
▶
📋Vendor Advisories
2💬Community
4Bugzilla▶
CVE-2020-10684 ansible: code injection when using ansible_facts as a subkey [openstack-rdo]↗2020-03-23
Bugzilla
▶
Bugzilla
▶