Code Injection, Race Condition, and Execution with Unnecessary Privileges in Ansible

高 7.1CVE-2020-10684 · GHSA-p62g-jhg6-v3rq · PYSEC-2020-207 · 24/03/2020 公開 · 17/06/2026 更新

要点

CVE-2020-10684 は ansible, ansible (redhat), ansible tower (redhat) に影響する深刻度「高」 (CVSS 7.1) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.33%（全脆弱性の 26.8% より高い）。
対処：2.7.17, 2.8.9, 2.8.11, 2.9.6 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
ansible PyPI	`≥ 2.7.0, < 2.7.17≥ 2.7.0a1, < 2.7.17≥ 2.8.0, < 2.8.9≥ 2.8.0a1, < 2.8.11≥ 2.9.0, < 2.9.6≥ 2.9.0a1, < 2.9.7`	`2.7.172.8.92.8.112.9.62.9.7`
ansible redhat	`≥ 2.7.0, < 2.7.17≥ 2.8.0, < 2.8.9≥ 2.9.0, < 2.9.6`	`2.7.172.8.92.9.6`
ansible tower redhat	`≥ 3.5.0, ≤ 3.5.5≥ 3.6.0, ≤ 3.6.3≤ 3.3.5`	修正版なし
openstack redhat	`= 10= 13`	修正版なし

概要

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.11, and 2.9.7 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.

NVD の説明

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.