Vulnerability · Published Mar 16, 2020 · Assigned by redhat
CVE-2020-1735
Medium 4.2
In plain English
A medium-severity path traversal in ansible from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)4.2Medium
Exploit odds (30 days)0.5%top 59.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | ansible | 2.9.7+dfsg-1 | DEBIAN-CVE-2020-1735 |
| Debian:13 | ansible | 2.9.7+dfsg-1 | DEBIAN-CVE-2020-1735 |
| Debian:14 | ansible | 2.9.7+dfsg-1 | DEBIAN-CVE-2020-1735 |
| PyPI | ansible | 2.7.18 | GHSA-gfr2-qpxh-qj9m |
| PyPI | ansible | 2.7.17, 2.8.9, 2.9.6 | PYSEC-2020-7 |
| PyPI | ansible | 2.8.12 | GHSA-gfr2-qpxh-qj9m |
| PyPI | ansible | 2.9.8 | GHSA-gfr2-qpxh-qj9m |
Affected products (as reported)
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1735 x_refsource_CONFIRM
- https://github.com/ansible/ansible/issues/67793 x_refsource_CONFIRM
- FEDORA-2020-1b6ce91e37 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-3990f03ba3 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-f80154b5b4 vendor-advisory, x_refsource_FEDORA
- GLSA-202006-11 vendor-advisory, x_refsource_GENTOO
- DSA-4950 vendor-advisory, x_refsource_DEBIAN