Skip to content
OpenAdvisories
Medium WID-SEC-2023-2478 5 CVEs

Ansible: Mehrere Schwachstellen

Published Mar 16, 2020 · Updated Jun 7, 2026 · Revision 10 · de-DE

Vendor: amazon Vendor: Debian Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Linux Product: Linux Product: Linux 2 Product: openSUSE Platform: Linux

Summary

Ein lokaler Angreifer kann mehrere Schwachstellen in Ansible ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen

Product

Ansible ist eine Software zur Automatisierung von Cloud Provisionierung,
zum Konfigurationsmanagement und zur Anwendungsbereitstellung.

Vulnerabilities 5

  • Medium 5.0
    CVE-2020-1753

    Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and Exposure of Sensitive Information to an Unauthorized Actor in Ansible

    A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as pass…

    Red Hat Ansible ansible ansible Debian Ubuntu PyPI
  • Medium 4.2
    CVE-2020-1735

    Path Traversal in Ansible

    A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be …

    Red Hat Ansible ansible ansible Debian Ubuntu PyPI
  • Low 3.9
    CVE-2020-1738

    Argument Injection in Ansible

    A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All ver…

    Red Hat Ansible ansible ansible Debian Ubuntu PyPI
  • Low 3.9
    CVE-2020-1740

    Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible

    A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the re…

    Red Hat Ansible ansible ansible Debian Ubuntu Alpine PyPI
  • Low 2.2
    CVE-2020-1736

    Incorrect Permission Assignment for Critical Resource in Ansible

    A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed t…

    Red Hat Ansible ansible ansible Debian Ubuntu PyPI

Revision history

  1. #10

    Neue Updates von openSUSE aufgenommen

  2. #9

    Neue Updates von openSUSE aufgenommen

  3. #8

    Neue Updates von openSUSE aufgenommen

  4. #7

    Neue Updates von SUSE aufgenommen

  5. #6

    Neue Updates von Amazon aufgenommen

  6. #5

    Neue Updates von Debian aufgenommen

  7. #4

    Neue Updates von Red Hat aufgenommen

  8. #3

    Neue Updates von Debian aufgenommen

  9. #2

    Neue Updates von Red Hat aufgenommen

  10. #1

    Initiale Fassung

References