Skip to content
OpenAdvisories
High RHSA-2020:1544 8 CVEs

Red Hat Security Advisory: Ansible security and bug fix update (2.7.17)

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · Ansible Engine 2 ansible_engine:2.7::el7 ansible 0:2.7.17-1.el7ae

Vulnerabilities 8

  • High 7.9
    CVE-2020-10684

    Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible

    A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after th…

    Red Hat Ansible ansible ansible Debian Ubuntu PyPI
  • High 7.5
    CVE-2020-1737

    Path Traversal in Ansible

    A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantag…

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  • Medium 5.0
    CVE-2020-10685

    Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible

    A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault fi…

    Red Hat Ansible ansible ansible Debian Ubuntu PyPI
  • Medium 5.0
    CVE-2020-1733

    Ansible vulnerable to Exposure of Resource to Wrong Sphere and Insecure Temporary File

    A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp.…

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  • Medium 5.0
    CVE-2020-1746

    Exposure of Sensitive Information to an Unauthorized Actor in ansible

    A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry comm…

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  • Medium 4.2
    CVE-2020-1735

    Path Traversal in Ansible

    A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be …

    Red Hat Ansible ansible ansible Debian Ubuntu PyPI
  • Low 3.9
    CVE-2020-1739

    Exposure of Sensitive Information to an Unauthorized Actor in Ansible

    A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advant…

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  • Low 3.9
    CVE-2020-1740

    Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible

    A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the re…

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1801735
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1802085
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1802154
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1802178
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1802193
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1805491
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1814627
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1815519
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1544.json
  • report
    https://access.redhat.com/security/cve/CVE-2020-1733
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1733
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1733
  • report
    https://access.redhat.com/security/cve/CVE-2020-1735
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1735
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1735
  • report
    https://access.redhat.com/security/cve/CVE-2020-1737
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1737
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1737
  • report
    https://access.redhat.com/security/cve/CVE-2020-1739
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1739
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1739
  • report
    https://access.redhat.com/security/cve/CVE-2020-1740
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1740
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1740
  • report
    https://access.redhat.com/security/cve/CVE-2020-1746
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-1746
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-1746
  • report
    https://access.redhat.com/security/cve/CVE-2020-10684
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-10684
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-10684
  • report
    https://access.redhat.com/security/cve/CVE-2020-10685
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2020-10685
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2020-10685