A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
References
Link | Resource |
---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738 | Issue Tracking Vendor Advisory |
https://github.com/ansible/ansible/issues/67796 | Third Party Advisory |
https://security.gentoo.org/glsa/202006-11 |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: redhat
Published: 2020-03-16T15:08:03
Updated: 2020-06-13T03:06:10
Reserved: 2019-11-27T00:00:00
Link: CVE-2020-1738
JSON object: View
NVD Information
Status : Modified
Published: 2020-03-16T16:15:14.093
Modified: 2023-11-07T03:19:31.530
Link: CVE-2020-1738
JSON object: View
Redhat Information
No data.
CWE