CVE-2020-10684 Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible
Attackers can inject code or escalate privileges by manipulating ansible_facts when variable injection is enabled in Ansible Engine.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-10684?
CVE-2020-10684 is a high-severity code injection vulnerability in Debian Debian Linux, published on 24 Mar 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
Which versions are affected by CVE-2020-10684?
7 open source packages ship an affected version, including ansible. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
ansible PyPI | From 2.7.0 | 2.7.17, 2.8.9, 2.9.6 |
ansible PyPI | From 2.7.0a1 | 2.7.17 |
ansible PyPI | From 2.7.0a1 | 2.7.17 |
ansible PyPI | From 2.8.0a1 | 2.8.11 |
ansible PyPI | From 2.8.0a1 | 2.8.11 |
ansible PyPI | From 2.9.0a1 | 2.9.7 |
1 more packages
ansible PyPI | From 2.9.0a1 | 2.9.7 |
Products include Debian Debian Linux, Fedoraproject Fedora, Redhat Ansible, Redhat Ansible Tower, Redhat Openstack.
How do I fix CVE-2020-10684?
Upgrade ansible to a fixed version for your release line: 2.7.17, 2.8.9, 2.9.6 or 2.8.11.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2020-10684 being exploited?
There is no known exploitation of CVE-2020-10684 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2020-10684, GHSA-p62g-jhg6-v3rq, PYSEC-2020-207, UBUNTU-CVE-2020-10684.