Vulnerability · Published Sep 23, 2020 · Assigned by redhat

CVE-2020-14365

High 7.1

In plain English

A high-severity security flaw in ansible. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.1High

Exploit odds (30 days)0.2%top 85.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ansible	2.9.13+dfsg-1	DEBIAN-CVE-2020-14365
Debian:13	ansible	2.9.13+dfsg-1	DEBIAN-CVE-2020-14365
Debian:14	ansible	2.9.13+dfsg-1	DEBIAN-CVE-2020-14365
PyPI	ansible	2.8.16rc1, 2.9.14rc1	PYSEC-2020-209
PyPI	ansible	2.8.15	GHSA-m429-fhmv-c6q2
PyPI	ansible	2.9.13	GHSA-m429-fhmv-c6q2
Ubuntu:24.04:LTS	ansible	no fix listed	UBUNTU-CVE-2020-14365
Ubuntu:25.10	ansible	no fix listed	UBUNTU-CVE-2020-14365
Ubuntu:26.04:LTS	ansible	no fix listed	UBUNTU-CVE-2020-14365
Ubuntu:26.10	ansible	no fix listed	UBUNTU-CVE-2020-14365

Affected products (as reported)

Vendor	Product	Versions
n/a	ansible	ansible-engine 2.8.15, ansible-engine 2.9.13

Weakness: CWE-347

References

https://bugzilla.redhat.com/show_bug.cgi?id=1869154 x_refsource_MISC
DSA-4950 vendor-advisory, x_refsource_DEBIAN