VulnerableCode Package Details - pkg:rpm/redhat/ansible@2.8.11-1?arch=el8ae

Search for packages

Vulnerability	Summary	Fixed by
VCID-ae1r-yq1g-rkem Aliases: CVE-2020-1737 GHSA-893h-35v4-mxqx PYSEC-2020-9	A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.	There are no reported fixed by versions.
VCID-b8zs-br97-57av Aliases: CVE-2020-1739 GHSA-923p-fr2c-g5m2 PYSEC-2020-11	A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.	There are no reported fixed by versions.
VCID-ezux-6buh-h7h7 Aliases: CVE-2020-10685 GHSA-77g3-3j5w-64w4 PYSEC-2020-1	A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.	There are no reported fixed by versions.
VCID-h1n3-cmte-eugf Aliases: CVE-2020-1746 GHSA-j2h6-73x8-22c4 PYSEC-2020-13	A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.	There are no reported fixed by versions.
VCID-hqar-fca3-cbht Aliases: CVE-2020-1733 GHSA-g4mq-6fp5-qwcf PYSEC-2020-5	A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.	There are no reported fixed by versions.
VCID-xg2f-12w4-yqge Aliases: CVE-2020-10684 GHSA-p62g-jhg6-v3rq PYSEC-2020-207	A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.	There are no reported fixed by versions.
VCID-yur3-am6j-w7ay Aliases: CVE-2020-1740 GHSA-vcg8-98q8-g7mj PYSEC-2020-12	A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.	There are no reported fixed by versions.
VCID-zzzs-scbg-bbe9 Aliases: CVE-2020-1735 GHSA-gfr2-qpxh-qj9m PYSEC-2020-7	A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-ae1r-yq1g-rkem
Aliases:
CVE-2020-1737
GHSA-893h-35v4-mxqx
PYSEC-2020-9

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.