Vulnerability · Published Mar 16, 2020 · Assigned by redhat

CVE-2020-1753

Medium 5.0

In plain English

A medium-severity information exposure in Ansible from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.0Medium

Exploit odds (30 days)0.5%top 56.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	ansible	2.9.16+dfsg-1	DEBIAN-CVE-2020-1753
Debian:13	ansible	2.9.16+dfsg-1	DEBIAN-CVE-2020-1753
Debian:14	ansible	2.9.16+dfsg-1	DEBIAN-CVE-2020-1753
PyPI	ansible	2.7.18, 2.8.11, 2.9.7	PYSEC-2020-210
PyPI	ansible	2.7.18	GHSA-86hp-cj9j-33vv
PyPI	ansible	2.8.12	GHSA-86hp-cj9j-33vv
PyPI	ansible	2.9.7	GHSA-86hp-cj9j-33vv
Ubuntu:24.04:LTS	ansible	no fix listed	UBUNTU-CVE-2020-1753
Ubuntu:25.10	ansible	no fix listed	UBUNTU-CVE-2020-1753
Ubuntu:26.04:LTS	ansible	no fix listed	UBUNTU-CVE-2020-1753
Ubuntu:26.10	ansible	no fix listed	UBUNTU-CVE-2020-1753

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Ansible	all Ansible 2.7.x versions prior to 2.7.17all Ansible 2.8.x versions prior to 2.8.11all Ansible 2.9.x versions prior to 2.9.7

Weakness: CWE-200, CWE-214, CWE-532 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1753 x_refsource_CONFIRM
https://github.com/ansible-collections/kubernetes/pull/51 x_refsource_CONFIRM
FEDORA-2020-1b6ce91e37 vendor-advisory, x_refsource_FEDORA
FEDORA-2020-3990f03ba3 vendor-advisory, x_refsource_FEDORA
FEDORA-2020-f80154b5b4 vendor-advisory, x_refsource_FEDORA
GLSA-202006-11 vendor-advisory, x_refsource_GENTOO
DSA-4950 vendor-advisory, x_refsource_DEBIAN