CVE-2020-1738

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

CVSS v3 3.9 LOW
CVSS v2.0 2.6 LOW

3.9^/10

CVSS v3 : LOW

Vector :

Exploitability : 0.8 / Impact : 2.7

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:H/Au:N/C:N/I:P/A:P

Exploitability : 1.9 / Impact : 4.9

Access Vector LOCAL

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738	Issue Tracking Vendor Advisory
https://github.com/ansible/ansible/issues/67796	Third Party Advisory
https://security.gentoo.org/glsa/202006-11
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738	Issue Tracking Vendor Advisory
https://github.com/ansible/ansible/issues/67796	Third Party Advisory
https://security.gentoo.org/glsa/202006-11

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:redhat:ansible::::::::
	cpe:2.3:a:redhat:ansible::::::::
	cpe:2.3:a:redhat:ansible::::::::
	cpe:2.3:a:redhat:ansible_tower::::::::
	cpe:2.3:a:redhat:ansible_tower::::::::
	cpe:2.3:a:redhat:ansible_tower::::::::
	cpe:2.3:a:redhat:ansible_tower::::::::
	cpe:2.3:a:redhat:cloudforms_management_engine:5.0:::::::*
	cpe:2.3:a:redhat:openstack:13:::::::*

History

No history.

Information

Published : 2020-03-16 16:15

Updated : 2024-11-21 05:11

NVD link : CVE-2020-1738

Mitre link : CVE-2020-1738

CVE.ORG link : CVE-2020-1738

JSON object : View

Products Affected

redhat

ansible_tower
openstack
cloudforms_management_engine
ansible

CWE

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

{"id": "CVE-2020-1738", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:H/Au:N/C:N/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 1.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.7, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.9, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 2.7, "exploitabilityScore": 0.8}]}, "published": "2020-03-16T16:15:14.093", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://github.com/ansible/ansible/issues/67796", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://security.gentoo.org/glsa/202006-11", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ansible/ansible/issues/67796", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://security.gentoo.org/glsa/202006-11", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-88"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-88"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable."}, {"lang": "es", "value": "Se detect\u00f3 un fallo en Ansible Engine, cuando el paquete o servicio del m\u00f3dulo es usado y el par\u00e1metro \"use\" no es especificado. Si una tarea anterior es ejecutada con un usuario malicioso, el m\u00f3dulo enviado puede ser seleccionado por parte del atacante usando el archivo de datos de ansible. Se cree que todas las versiones en las derivaciones 2.7.x, 2.8.x y 2.9.x son vulnerables."}], "lastModified": "2024-11-21T05:11:16.820", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "89338CDC-A956-4F24-A2A2-EA5CFD78F235", "versionEndIncluding": "2.7.16"}, {"criteria": "cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D144C559-37B8-4DED-9D8B-61CE1134B3A5", "versionEndIncluding": "2.8.8", "versionStartIncluding": "2.8.0"}, {"criteria": "cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FA56E1B5-A742-4D2E-BF0B-C806689A3E05", "versionEndIncluding": "2.9.5", "versionStartIncluding": "2.9.0"}, {"criteria": "cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C3C5721F-050A-42A3-A71D-6C6BA23D58FE", "versionEndIncluding": "3.3.4"}, {"criteria": "cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64DD1400-5512-493E-85DB-B3C18FBB2DBB", "versionEndIncluding": "3.4.5", "versionStartIncluding": "3.3.5"}, {"criteria": "cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2062F74-68D8-4E75-BC69-6038B519F823", "versionEndIncluding": "3.5.5", "versionStartIncluding": "3.5.0"}, {"criteria": "cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "342D4A63-0972-413B-BD65-0495DBF1CDFB", "versionEndIncluding": "3.6.3", "versionStartIncluding": "3.6.0"}, {"criteria": "cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7098B44F-56BF-42E3-8831-48D0A8E99EE2"}, {"criteria": "cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "704CFA1A-953E-4105-BFBE-406034B83DED"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}