{"answers":{"affected":"7 open source packages ship an affected version, including ansible. It affects 4 products.","exploited":"There is no known exploitation of CVE-2020-1753 in the wild and no public exploit code.","fix":"Upgrade ansible to a fixed version for your release line: 2.7.18, 2.8.11, 2.9.7 or 2.8.12.","what":"CVE-2020-1753 is a medium-severity vulnerability in Debian Debian Linux, published on 16 Mar 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2020-1753 and fix it if it is affected.\n\nWhat it is: CVE-2020-1753 is a medium-severity vulnerability in Debian Debian Linux, published on 16 Mar 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2020-1753 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- ansible (PyPI): affected all versions; fixed in 2.7.18, 2.8.11, 2.9.7\n- ansible (PyPI): affected from 2.7.0a1; fixed in 2.7.18\n- ansible (PyPI): affected from 2.7.0a1; fixed in 2.7.18\n- ansible (PyPI): affected from 2.8.0a1; fixed in 2.8.12\n- ansible (PyPI): affected from 2.8.0a1; fixed in 2.8.12\n- ansible (PyPI): affected from 2.9.0a1; fixed in 2.9.7\n- ansible (PyPI): affected from 2.9.0a1; fixed in 2.9.7\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2020-1753/ (Markdown: https://insights.sbomify.com/CVE-2020-1753/index.md)","id":"CVE-2020-1753","markdown":"https://insights.sbomify.com/CVE-2020-1753/index.md","name":"CVE-2020-1753","record":{"aliases":["DEBIAN-CVE-2020-1753","GHSA-86hp-cj9j-33vv","PYSEC-2020-210","RHBA-2020:4195","RHSA-2020:2142","UBUNTU-CVE-2020-1753"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Ansible Engine","requires_auth":"low_privilege","summary":"Ansible Engine exposes sensitive Kubernetes credentials in process lists and logs, allowing attackers to read secrets.","user_interaction":"required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[{"product":"debian_linux","vendor":"debian"},{"product":"fedora","vendor":"fedoraproject"},{"product":"ansible_engine","vendor":"redhat"},{"product":"ansible_tower","vendor":"redhat"}],"cvss":{"score":5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-532","name":"Insertion of Sensitive Information into Log File"},{"id":"CWE-214","name":"Invocation of Process Using Visible Sensitive Information"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.","ecosystems":["PyPI","Red Hat:ansible_engine:2.7::el7","Red Hat:ansible_engine:2.8::el7","Red Hat:ansible_engine:2.8::el8"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Insertion of Sensitive Information into Log File, Invocation of Process Using Visible Sensitive Information, and Exposure of Sensitive Information to an Unauthorized Actor in Ansible","id":"CVE-2020-1753","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":"debian:debian_linux","products":["debian:debian_linux","fedoraproject:fedora","redhat:ansible_tower"],"type":"information_disclosure","year":"2020"},"n_packages":10,"n_references":7,"next":{"headline":"Missing authorization in Moodle","id":"CVE-2020-1754"},"packages":[{"ecosystem":"PyPI","fixed":["2.7.18","2.8.11","2.9.7"],"introduced":["0","2.8.0","2.9.0"],"last_affected":[],"package":"ansible","purl":"pkg:pypi/ansible","source":"PYSEC-2020-210"},{"ecosystem":"PyPI","fixed":["2.7.18"],"introduced":["2.7.0a1"],"last_affected":[],"package":"ansible","purl":null,"source":"GHSA-86hp-cj9j-33vv"},{"ecosystem":"PyPI","fixed":["2.7.18"],"introduced":["2.7.0a1"],"last_affected":[],"package":"ansible","purl":"pkg:pypi/ansible","source":"GHSA-86hp-cj9j-33vv"},{"ecosystem":"PyPI","fixed":["2.8.12"],"introduced":["2.8.0a1"],"last_affected":[],"package":"ansible","purl":null,"source":"GHSA-86hp-cj9j-33vv"},{"ecosystem":"PyPI","fixed":["2.8.12"],"introduced":["2.8.0a1"],"last_affected":[],"package":"ansible","purl":"pkg:pypi/ansible","source":"GHSA-86hp-cj9j-33vv"},{"ecosystem":"PyPI","fixed":["2.9.7"],"introduced":["2.9.0a1"],"last_affected":[],"package":"ansible","purl":null,"source":"GHSA-86hp-cj9j-33vv"},{"ecosystem":"PyPI","fixed":["2.9.7"],"introduced":["2.9.0a1"],"last_affected":[],"package":"ansible","purl":"pkg:pypi/ansible","source":"GHSA-86hp-cj9j-33vv"},{"ecosystem":"Red Hat:ansible_engine:2.7::el7","fixed":["0:2.7.18-1.el7ae"],"introduced":["0"],"last_affected":[],"package":"ansible","purl":"pkg:rpm/redhat/ansible","source":"RHSA-2020:2142"},{"ecosystem":"Red Hat:ansible_engine:2.8::el7","fixed":["0:2.8.16-1.el7ae"],"introduced":["0"],"last_affected":[],"package":"ansible","purl":"pkg:rpm/redhat/ansible","source":"RHBA-2020:4195"},{"ecosystem":"Red Hat:ansible_engine:2.8::el8","fixed":["0:2.8.16-1.el8ae"],"introduced":["0"],"last_affected":[],"package":"ansible","purl":"pkg:rpm/redhat/ansible","source":"RHBA-2020:4195"}],"prev":{"headline":"Use after free in glibc","id":"CVE-2020-1752"},"products":["Ansible"],"published":"2020-03-16","related":[{"cvss_score":10,"headline":"ProFTPD Improper Access Control","id":"CVE-2015-3306","kev_date_added":"2026-10-08","published":"2015-05-18"},{"cvss_score":9.9,"headline":"RoundCube Webmail Deserialization of Untrusted Data","id":"CVE-2025-49113","kev_date_added":"2026-02-20","published":"2025-06-02"},{"cvss_score":9.8,"headline":"GNU InetUtils Argument Injection","id":"CVE-2026-24061","kev_date_added":"2026-01-26","published":"2026-01-21"},{"cvss_score":9.8,"headline":"Linux Kernel Improper Check for Unusual or Exceptional Conditions","id":"CVE-2025-39682","kev_date_added":"2026-09-18","published":"2025-09-05"},{"cvss_score":9.8,"headline":"Mozilla Firefox Use-After-Free","id":"CVE-2024-9680","kev_date_added":"2024-10-15","published":"2024-10-09"},{"cvss_score":9.8,"headline":"RARLAB UnRAR Directory Traversal","id":"CVE-2022-30333","kev_date_added":"2022-08-09","published":"2022-05-09"},{"cvss_score":9.8,"headline":"Roundcube Webmail SQL Injection","id":"CVE-2021-44026","kev_date_added":"2023-06-22","published":"2021-11-19"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHBA"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["Red Hat"]},"summary":"Ansible Engine exposes sensitive Kubernetes credentials in process lists and logs, allowing attackers to read secrets.","url":"https://insights.sbomify.com/CVE-2020-1753/"}