Archive
16 March 2020
Vulnerabilities first published on this day (UTC), newest first.
3 results · Clear filters · Feed
-
Low 3.9
Argument Injection in Ansible
A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All ver…
-
Low 3.9
Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible
A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the re…
-
Low 2.2
Incorrect Permission Assignment for Critical Resource in Ansible
A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed t…