CVE-2020-1734 OS Command Injection in ansible

What is CVE-2020-1734?

CVE-2020-1734 is a high-severity command injection vulnerability in Redhat Ansible Tower, published on 3 Mar 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.

Weakness: CWE-78

Which versions are affected by CVE-2020-1734?

7 open source packages ship an affected version, including ansible. It affects 2 products.

Products include Redhat Ansible Engine, Redhat Ansible Tower.

How do I fix CVE-2020-1734?

Upgrade ansible to a fixed version for your release line: 2.7.17, 2.8.13, 2.10.0rc1 or 2.9.11.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-1734 being exploited?

There is no known exploitation of CVE-2020-1734 in the wild and no public exploit code.

Other vulnerabilities in Redhat Ansible Tower

• CVE-2018-10874 Ansible Improper Input Validation vulnerability High 7.8
• CVE-2020-1737 Path Traversal in Ansible High 7.5
• CVE-2019-14858 Ansible leaks sensitive information to logs when told not to High 7.3
• CVE-2020-10691 Path Traversal in Ansible Medium 5.2
• CVE-2018-16859 Ansible Logs Passwords If PowerShell ScriptBlock is Enabled Medium 4.2

All Redhat Ansible Tower vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2020-1734, GHSA-h39q-95q5-9jfp, PYSEC-2020-6, UBUNTU-CVE-2020-1734.