Use of insufficiently random values in Ansible - CVE-2020-10729
Published: August 8, 2021
Vulnerability identifier: #VU55643
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-10729
CWE-ID: CWE-330
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to usegae of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens.
Affected software
Ansible
ansible (Debian package)
ansible
ansible-help
openEuler
ansible (Debian package)
ansible
ansible-help
openEuler
How to mitigate CVE-2020-10729
Install updates from vendor's website.
Ansible - update to 2.9.6
ansible (Debian package) - update to 2.7.7+dfsg-1+deb10u1
ansible - addressed in versions 2.5.5-2, 2.5.5-6
ansible-help - addressed in versions 2.5.5-2, 2.5.5-6
ansible (Debian package) - update to 2.7.7+dfsg-1+deb10u1
ansible - addressed in versions 2.5.5-2, 2.5.5-6
ansible-help - addressed in versions 2.5.5-2, 2.5.5-6