Code Injection in Red Hat Ansible Engine - CVE-2020-10684

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU29017

Code Injection in Red Hat Ansible Engine - CVE-2020-10684

Published: June 15, 2020


Vulnerability identifier: #VU29017
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-10684
CWE-ID: CWE-94
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when using "ansible_facts" as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the "ansible_facts" after the clean. A local user can alter the "ansible_facts", such as "ansible_hosts", "users" and any other key data which would lead into privilege escalation or code injection

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

Red Hat Ansible Engine
Gentoo Linux
Fedora
openEuler
ansible (Debian package)
ansible
ansible-help
ansible (Red Hat package)
Ansible

How to mitigate CVE-2020-10684

Install updates from vendor's website.

Red Hat Ansible Engine - addressed in versions 2.7.17, 2.8.9, 2.9.6
ansible (Debian package) - update to 2.7.7+dfsg-1+deb10u1
ansible - addressed in versions 2.5.5-2, 2.5.5-6
ansible-help - addressed in versions 2.5.5-2, 2.5.5-6
Ansible - addressed in versions 2.7.17-1.el7ae, 2.8.11-1.el7ae, 2.8.11-1.el8ae, 2.9.7-1.el7ae, 2.9.7-1.el8ae
ansible - addressed in versions 2.9.7-1.el7, 2.9.7-1.el8, 2.9.7-1.fc30, 2.9.7-1.fc31, 2.9.7-1.fc32
ansible (Red Hat package) - addressed in versions 2.9.7-1.el7ae, 2.9.7-1.el8ae

External References

Related Security Bulletins