Vulnerability · Published Sep 11, 2020 · Assigned by redhat
CVE-2020-14332
Medium 5.5
In plain English
A medium-severity security flaw in Ansible from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.4%top 64.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ansible | 2.9.13+dfsg-1 | DEBIAN-CVE-2020-14332 |
| Debian:13 | ansible | 2.9.13+dfsg-1 | DEBIAN-CVE-2020-14332 |
| Debian:14 | ansible | 2.9.13+dfsg-1 | DEBIAN-CVE-2020-14332 |
| PyPI | ansible | 2.8.14, 2.9.12 | PYSEC-2020-4 |
| PyPI | ansible | 2.8.14 | GHSA-j667-c2hm-f2wp |
| PyPI | ansible | 2.9.12 | GHSA-j667-c2hm-f2wp |
| PyPI | ansible | 2.10.1rc2 | GHSA-j667-c2hm-f2wp |
| Ubuntu:24.04:LTS | ansible | no fix listed | UBUNTU-CVE-2020-14332 |
| Ubuntu:25.10 | ansible | no fix listed | UBUNTU-CVE-2020-14332 |
| Ubuntu:26.04:LTS | ansible | no fix listed | UBUNTU-CVE-2020-14332 |
| Ubuntu:26.10 | ansible | no fix listed | UBUNTU-CVE-2020-14332 |
Affected products (as reported)
Weakness: CWE-117 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/ansible/ansible/pull/71033 x_refsource_MISC
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14332 x_refsource_CONFIRM
- DSA-4950 vendor-advisory, x_refsource_DEBIAN