CVE-2020-1735
published 2020-03-16CVE-2020-1735: A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new…
medium4.6CVSS 3.1
AVLACLPRHUINSCCLILAN
A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ansible | < ansible 2.9.7+dfsg-1 (bookworm) | ansible 2.9.7+dfsg-1 (bookworm) |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| red_hat | ansible | — | — |
| redhat | ansible | < 2.7.17 | 2.7.17 |
| redhat | ansible | >= 0 < 2.9.7+dfsg-1 | 2.9.7+dfsg-1 |
| redhat | ansible | >= 0 < 2.9.7+dfsg-1 | 2.9.7+dfsg-1 |
| redhat | ansible | >= 0 < 2.9.7+dfsg-1 | 2.9.7+dfsg-1 |
| redhat | ansible | >= 0 < 2.9.7+dfsg-1 | 2.9.7+dfsg-1 |
| redhat | ansible | >= 2.7.0a1 < 2.7.18 | 2.7.18 |
| redhat | ansible | >= 2.8.0 < 2.8.11 | 2.8.11 |
| redhat | ansible | >= 2.8.0a1 < 2.8.12 | 2.8.12 |
| redhat | ansible | >= 2.9.0 < 2.9.7 | 2.9.7 |
| redhat | ansible | >= 2.9.0a1 < 2.9.8 | 2.9.8 |
| redhat | ansible_tower | <= 3.3.4 | — |
| redhat | ansible_tower | 3.3.5 – 3.4.5 | — |
| redhat | ansible_tower | 3.5.0 – 3.5.5 | — |
| redhat | ansible_tower | 3.6.0 – 3.6.3 | — |
| redhat | cloudforms_management_engine | — | — |
| redhat | openstack | — | — |
CVSS provenance
nvdv3.14.6MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
osv4.6MEDIUM