Low severity · published Mar 16, 2020
CVE-2020-1738
A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified
3.9
CVSS
0.4%
EPSS
No
On KEV
Description
A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Ansible · Redhat
through 2.7.16; 2.8.0 through 2.8.8; 2.9.0 through 2.9.5 · source: NVD
AT
Ansible Tower · Redhat
through 3.3.4; 3.3.5 through 3.4.5; 3.5.0 through 3.5.5; 3.6.0 through 3.6.3 · source: NVD
CM
Cloudforms Management Engine · Redhat
5.0 · source: NVD
OP
Openstack · Redhat
13 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-1738
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-1738
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738
Third Party Advisory
https://github.com/ansible/ansible/issues/67796
security.gentoo.org
https://security.gentoo.org/glsa/202006-11
More from Ansible
9.8
CVE-2014-4657
The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions
9.8
CVE-2014-4678
The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions
9.8
CVE-2014-4967
Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing…
9.8
CVE-2014-4966
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to…
9.8
CVE-2017-7550
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module