Vulnerability · Published May 12, 2020 · Assigned by redhat

CVE-2020-1746

Medium 5.0

In plain English

A medium-severity information exposure in ansible from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.4%top 66.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ansible	2.9.7+dfsg-1	DEBIAN-CVE-2020-1746
Debian:13	ansible	2.9.7+dfsg-1	DEBIAN-CVE-2020-1746
Debian:14	ansible	2.9.7+dfsg-1	DEBIAN-CVE-2020-1746
PyPI	ansible	2.8.11	GHSA-j2h6-73x8-22c4
PyPI	ansible	2.9.7	GHSA-j2h6-73x8-22c4
PyPI	ansible	2.7.17	GHSA-j2h6-73x8-22c4
PyPI	ansible	2.7.17, 2.8.11, 2.9.7	PYSEC-2020-13

Affected products (as reported)

Vendor	Product	Versions
Red Hat	ansible	ansible-engine versions 2.7.x before 2.7.17ansible-engine versions 2.8.x before 2.8.11ansible-engine versions 2.9.x before 2.9.7Ansible Tower <= 3.4.5Ansible Tower <= 3.5.5Ansible Tower <= 3.6.3

Weakness: CWE-200 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1746 x_refsource_CONFIRM
https://github.com/ansible/ansible/pull/67866 x_refsource_CONFIRM
DSA-4950 vendor-advisory, x_refsource_DEBIAN