ansible
At a glance
- Source
- NVD
- EPSS
- EPSS 0.23 % · percentile 14 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Modified
Description
A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.
Weaknesses (CWE)
- CWE-347 — Improper Verification of Cryptographic Signature
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.6 | AV:L/AC:L/Au:N/C:N/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-m429-fhmv-c6q2 — Improper Verification of Cryptographic Signature in ansible
- PYSEC-2020-209 — A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf mod
European references
- ENISA EUVD · EUVD-2020-0021
- GCVE · GCVE-0-2020-14365
Affected configurations (NVD CPE)
cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*≥ 2.8.0 ≤ 2.8.15cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*≥ 2.9.0 ≤ 2.9.13cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*≥ 3.6.0 ≤ 3.6.5cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*≥ 3.7.0 ≤ 3.7.2cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:ceph_storage:2.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:openstack_platform:10.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| ansible | affected ansible-engine 2.8.15, ansible-engine 2.9.13 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |