CVE-2020-1734: OS Command Injection
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.
Other sources
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.
— MITRE
The pipe lookup plugin uses subprocess.Popen() with shell=True. This can be used to run arbitrary commands by overwriting ansible facts and the variable is not escaped by quote plugin.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.8.13 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.9.11 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.10.0rc1
Event History
Frequently Asked Questions
What is CVE-2020-1734?
CVE-2020-1734 is a vulnerability in the pipe lookup plugin of Ansible that allows arbitrary commands to be run.
How does CVE-2020-1734 work?
CVE-2020-1734 works by overwriting Ansible facts and running arbitrary commands when the pipe lookup plugin uses subprocess.Popen() with shell=True and the variable is not escaped by the quote plugin.
What is the severity of CVE-2020-1734?
The severity of CVE-2020-1734 is high with a CVSS score of 7.4.
Which versions of Ansible are affected by CVE-2020-1734?
Versions up to and including Ansible 2.10 are affected by CVE-2020-1734.
How can I fix CVE-2020-1734?
To fix CVE-2020-1734, upgrade to a version of Ansible that is not affected by the vulnerability.