CVSS: 5.5EPSS: 0%CPEs: 13EXPL: 0CVE-2020-10685 – Ansible: modules which use files encrypted with vault are not properly cleaned up
https://notcve.org/view.php?id=CVE-2020-10685
A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10685 https://github.com/ansible/ansible/pull/68433 https://security.gentoo.org/glsa/202006-11 https://www.debian.org/security/2021/dsa-4950 https://access.redhat.com/security/cve/CVE-2020-10685 https://bugzilla.redhat.com/show_bug.cgi?id=1814627 • CWE-459: Incomplete Cleanup •
CVSS: 5.0EPSS: 0%CPEs: 7EXPL: 0CVE-2020-1746 – ansible: Information disclosure issue in ldap_attr and ldap_entry modules
https://notcve.org/view.php?id=CVE-2020-1746
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality. Se detectó un fallo en el Ansible Engine que afectaba a las versiones 2.7.x anteriores a 2.7.17 y versiones 2.8.x anteriores a 2.8.11 y versiones 2.9.x anteriores a 2.9.7 así como en Ansible Tower versiones anteriores e incluyendo a 3.4.5 y 3.5.5 y 3.6.3, cuando son usados los módulos de la comunidad ldap_attr y ldap_entry. El problema revela la contraseña de enlace de LDAP en stdout o un archivo de registro si una tarea del playbook se escribe usando el bind_pw en el campo parameters. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1746 https://github.com/ansible/ansible/pull/67866 https://www.debian.org/security/2021/dsa-4950 https://access.redhat.com/security/cve/CVE-2020-1746 https://bugzilla.redhat.com/show_bug.cgi?id=1805491 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 11EXPL: 1CVE-2020-1753 – Ansible: kubectl connection plugin leaks sensitive information
https://notcve.org/view.php?id=CVE-2020-1753
A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files. Se detectó un fallo de seguridad en Ansible Engine, todas las versiones de Ansible 2.7.x anteriores a 2.7.17, todas las versiones de Ansible 2.8.x anteriores a 2.8.11 y todas las versiones de Ansible 2.9.x anteriores a 2.9.7, cuando se administra kubernetes usando el módulo k8s. Los parámetros confidenciales, tales como contraseñas y tokens, son pasados a kubectl desde la línea de comandos, sin utilizar una variable de entorno o un archivo de configuración de entrada. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1753 https://github.com/ansible-collections/kubernetes/pull/51 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB https://security.gentoo.org/glsa/202006-11 https: • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-214: Invocation of Process Using Visible Sensitive Information CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 7.8EPSS: 0%CPEs: 7EXPL: 0CVE-2020-1737 – ansible: Extract-Zip function in win_unzip module does not check extracted path
https://notcve.org/view.php?id=CVE-2020-1737
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10. Se detectó un fallo en Ansible versiones 2.7.17 y anteriores, versiones 2.8.9 y anteriores, y versiones 2.9.6 y anteriores, cuando se usa la función Extract-Zip desde el módulo win_unzip ya que los archivos extraídos no son comprobados si pertenecen a la carpeta de destino. Un atacante podría tomar ventaja de este fallo al crear un archivo en cualquier parte del sistema de archivos, utilizando un salto de ruta. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737 https://github.com/ansible/ansible/issues/67795 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2 https://security.gentoo.org/glsa/202006-11 https://a • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.4EPSS: 0%CPEs: 7EXPL: 0CVE-2020-1734
https://notcve.org/view.php?id=CVE-2020-1734
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts. Se encontró un fallo en el plugin pipe lookup de ansible. Los comandos arbitrarios se pueden ejecutar, cuando el plugin pipe lookup utiliza la función subprocess.Popen() con shell=True, al sobrescribir los datos de ansible y la variable no se escapa mediante el plugin citado. • https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1734 https://github.com/ansible/ansible/issues/67792 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •