CVE-2020-1735: Path Traversal

Q: What is CVE-2020-1735?

CVE-2020-1735 is a vulnerability found in the Ansible Engine when the fetch module is used, allowing an attacker to intercept the module and inject a new path.

Q: Which versions of Ansible Engine are affected by CVE-2020-1735?

All versions in the 2.7.x, 2.8.x, and 2.9.x branches of Ansible Engine are believed to be vulnerable.

Q: What is the severity of CVE-2020-1735?

CVE-2020-1735 has a severity level of medium.

Q: How can I fix CVE-2020-1735?

To fix CVE-2020-1735, you should update Ansible Engine to versions 2.7.17, 2.8.11, or 2.9.7, depending on the branch you are using.

Q: Where can I find more information about CVE-2020-1735?

You can find more information about CVE-2020-1735 on Red Hat's security page: https://access.redhat.com/security/cve/CVE-2020-1735.

Published Feb 12, 2020

Updated

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Other sources

When using the fetch module, a path injection allows a remote user to choose the destination path on the controller node. This vulnerability could be an insufficient patch of CVE-2019-3828.

— Red Hat

Affected Software

20 affected componentsFixes available

debian/ansible

2.7.7+dfsg-1+deb10u12.7.7+dfsg-1+deb10u22.10.7+merged+base+2.10.8+dfsg-17.3.0+dfsg-17.7.0+dfsg-3

redhat/ansible-engine<2.7.17

2.7.17

redhat/ansible-engine<2.8.11

2.8.11

redhat/ansible-engine<2.9.7

2.9.7

pip/ansible>=2.9.0a1<2.9.8

2.9.8

pip/ansible>=2.8.0a1<2.8.12

2.8.12

pip/ansible>=2.7.0a1<2.7.18

2.7.18

redhat ansible<2.7.17

redhat ansible>=2.8.0<2.8.11

redhat ansible>=2.9.0<2.9.7

redhat Ansible Tower<=3.3.4

redhat Ansible Tower>=3.3.5<=3.4.5

redhat Ansible Tower>=3.5.0<=3.5.5

redhat Ansible Tower>=3.6.0<=3.6.3

redhat CloudForms Management Engine=5.0

redhat Openstack=13

Debian Debian Linux=10.0

Fedoraproject Fedora=30

Fedoraproject Fedora=31

Fedoraproject Fedora=32

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/ansible to a version that resolves this vulnerability.
Fixed in 2.7.7+dfsg-1+deb10u1Fixed in 2.7.7+dfsg-1+deb10u2Fixed in 2.10.7+merged+base+2.10.8+dfsg-1Fixed in 7.3.0+dfsg-1Fixed in 7.7.0+dfsg-3
Upgrade
Upgrade redhat/ansible-engine to a version that resolves this vulnerability.
Fixed in 2.7.17
Upgrade
Upgrade redhat/ansible-engine to a version that resolves this vulnerability.
Fixed in 2.8.11
Upgrade
Upgrade redhat/ansible-engine to a version that resolves this vulnerability.
Fixed in 2.9.7
Upgrade
Upgrade pip/ansible to a version that resolves this vulnerability.
Fixed in 2.9.8
Upgrade
Upgrade pip/ansible to a version that resolves this vulnerability.
Fixed in 2.8.12
Upgrade
Upgrade pip/ansible to a version that resolves this vulnerability.
Fixed in 2.7.18

Event History

Mar 16, 2020

CVE Published

via MITRE·03:05 PM

Data Sourced

via MITRE·03:05 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Apr 7, 2021

Advisory Published

via GitHub·08:35 PM

Frequently Asked Questions

What is CVE-2020-1735?

CVE-2020-1735 is a vulnerability found in the Ansible Engine when the fetch module is used, allowing an attacker to intercept the module and inject a new path.

Which versions of Ansible Engine are affected by CVE-2020-1735?

All versions in the 2.7.x, 2.8.x, and 2.9.x branches of Ansible Engine are believed to be vulnerable.

What is the severity of CVE-2020-1735?