CVE-2020-1738

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2020-1738
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-1738.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-1738
Aliases
Related
Published
2020-03-16T16:15:14Z
Modified
2024-11-02T04:51:39.588637Z
Severity
  • 3.9 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:L CVSS Calculator
Summary
[none]
Details

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

References

Affected packages

Debian:11 / ansible

Package

Name
ansible
Purl
pkg:deb/debian/ansible?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.10.7+merged+base+2.10.8+dfsg-1
2.10.7+merged+base+2.10.17+dfsg-0+deb11u1

4.*

4.6.0-1

5.*

5.4.0-1
5.5.0-1

6.*

6.3.0+dfsg-1
6.4.0+dfsg-1

7.*

7.0.0+dfsg-1
7.0.0+dfsg-2
7.1.0+dfsg-1
7.2.0+dfsg-2
7.3.0+dfsg-1
7.7.0+dfsg-1
7.7.0+dfsg-2
7.7.0+dfsg-3

9.*

9.4.0+dfsg-1
9.5.1+dfsg-1

10.*

10.0.0+dfsg-1
10.0.1+dfsg-1
10.1.0+dfsg-1
10.5.0+dfsg-1
10.5.0+dfsg-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:12 / ansible

Package

Name
ansible
Purl
pkg:deb/debian/ansible?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.3.0+dfsg-1
7.7.0+dfsg-1
7.7.0+dfsg-2
7.7.0+dfsg-3
7.7.0+dfsg-3+deb12u1

9.*

9.4.0+dfsg-1
9.5.1+dfsg-1

10.*

10.0.0+dfsg-1
10.0.1+dfsg-1
10.1.0+dfsg-1
10.5.0+dfsg-1
10.5.0+dfsg-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Debian:13 / ansible

Package

Name
ansible
Purl
pkg:deb/debian/ansible?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

7.*

7.3.0+dfsg-1
7.7.0+dfsg-1
7.7.0+dfsg-2
7.7.0+dfsg-3

9.*

9.4.0+dfsg-1
9.5.1+dfsg-1

10.*

10.0.0+dfsg-1
10.0.1+dfsg-1
10.1.0+dfsg-1
10.5.0+dfsg-1
10.5.0+dfsg-2

Ecosystem specific 

{
    "urgency": "unimportant"
}

Git / github.com/ansible/ansible

Affected ranges

Type
GIT
Repo
https://github.com/ansible/ansible
Events
Introduced
24325a05dfb9104d6d4ec8b488b89e07c2e6d376
Last affected
9388be4269bdf83406bfa9245142de8b7dc8cfbc
Introduced
2611867fd1dc387ceaa0ffb8ce0f030aafc2a859
Last affected
d28e4b63c7b70acbaf0a1fedd53c91b6686574a0

Affected versions

v2.*

v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.8.6
v2.8.7
v2.8.8
v2.9.0
v2.9.1
v2.9.2
v2.9.3
v2.9.4
v2.9.5