CVE-2020-14365: High severity red hat ansible engine vulnerability
A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disablegpgcheck is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.
Other sources
A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disablegpgcheck is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.
The dnf ansible module is not checking GPG signatures when installing packages. This allows installing malicious packages previously stored in the dnf repository. This could lead in an integrity problem and service availability disruption.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Ansible Engine flaw?
The vulnerability ID for this Ansible Engine flaw is CVE-2020-14365.
What is the severity of CVE-2020-14365?
The severity of CVE-2020-14365 is high (severity value 7).
How does the vulnerability affect Ansible Engine?
The vulnerability affects Ansible Engine versions 2.8.x before 2.8.15 and 2.9.x before 2.9.13.
What is the default behavior of the vulnerability?
The default behavior of the vulnerability is to ignore GPG signatures during package installation, even when the 'disable_gpg_check' is set to 'False'.
How can the vulnerability be fixed?
To fix the vulnerability, update Ansible Engine to version 2.8.15 or 2.9.13, depending on the affected version.