CVE-2020-1734 — OS Command Injection in Redhat Ansible
Severity
7.4HIGHNVD
EPSS
0.1%
top 67.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 3
Latest updateFeb 9
Description
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:LExploitability: 0.8 | Impact: 6.0
Affected Packages4 packages
🔴Vulnerability Details
4📋Vendor Advisories
2💬Community
5Bugzilla▶
CVE-2020-27766 ImageMagick: outside the range of representable values of type 'unsigned long' at MagickCore/statistic.c↗2020-11-04
Bugzilla▶
CVE-2020-1734 ansible: shell enabled by default in a pipe lookup plugin subprocess [openstack-rdo]↗2020-02-27
Bugzilla▶
CVE-2020-1734 ansible: shell enabled by default in a pipe lookup plugin subprocess [fedora-all]↗2020-02-20
Bugzilla▶
CVE-2020-1734 ansible: shell enabled by default in a pipe lookup plugin subprocess [epel-all]↗2020-02-20
Bugzilla
▶