CVE-2020-10684: Code Injection
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.11, and 2.9.7 respectively, when using ansiblefacts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansiblefacts after the clean. An attacker could take advantage of this by altering the ansiblefacts, such as ansiblehosts, users and any other key data which would lead into privilege escalation or code injection.
Other sources
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansiblefacts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansiblefacts after the clean. An attacker could take advantage of this by altering the ansiblefacts, such as ansiblehosts, users and any other key data which would lead into privilege escalation or code injection.
Keys for ansiblefacts can be overwritten when ansiblefacts is added itself as a subkey. This action would happen after cleaning with unprocessed subkeys, as ansiblefacts could be added as a subkey.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-10684?
CVE-2020-10684 is a vulnerability in Ansible Engine that allows an attacker to overwrite ansible_facts after a clean.
What versions of Ansible Engine are affected by CVE-2020-10684?
Versions 2.7.x, 2.8.x, and 2.9.x of Ansible Engine prior to 2.7.17, 2.8.11, and 2.9.7 respectively are affected by CVE-2020-10684.
How can an attacker exploit CVE-2020-10684?
An attacker can exploit CVE-2020-10684 by using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean.
What is the severity of CVE-2020-10684?
CVE-2020-10684 has a severity rating of high.
How can I fix CVE-2020-10684?
To fix CVE-2020-10684, upgrade to Ansible Engine versions 2.7.17, 2.8.11, and 2.9.7 respectively.