CVE-2020-1734

Source

https://nvd.nist.gov/vuln/detail/CVE-2020-1734

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-1734.json

Aliases

• GHSA-h39q-95q5-9jfp
• PYSEC-2020-6

Published

2020-03-03T22:15:10Z

Modified

2023-11-29T08:09:23.193914Z

Details

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1734
• https://github.com/ansible/ansible/issues/67792