CVE-2020-10684
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2020-10684
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-10684.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2020-10684
- Aliases
- Related
- Published
- 2020-03-24T14:15:12Z
- Modified
- 2024-11-02T04:50:54.220965Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CVSS Calculator
- Summary
- [none]
- Details
-
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansiblefacts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansiblefacts after the clean. An attacker could take advantage of this by altering the ansiblefacts, such as ansiblehosts, users and any other key data which would lead into privilege escalation or code injection.
- References
-
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10684
- https://security.gentoo.org/glsa/202006-11
- https://www.debian.org/security/2021/dsa-4950
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/
- https://security-tracker.debian.org/tracker/CVE-2020-10684
Affected packages
Debian:11 / ansible
Package
- Name
- ansible
- Purl
- pkg:deb/debian/ansible?arch=source
Debian:12 / ansible
Package
- Name
- ansible
- Purl
- pkg:deb/debian/ansible?arch=source
Debian:13 / ansible
Package
- Name
- ansible
- Purl
- pkg:deb/debian/ansible?arch=source