CVE-2020-1746: Infoleak
First published: Thu Feb 20 2020(Updated: )
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the `bind_pw` in the parameters field. The highest threat from this vulnerability is data confidentiality.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/ansible | >=2.9.0<2.9.7 | 2.9.7 |
| pip/ansible | >=2.8.0<2.8.11 | 2.8.11 |
| pip/ansible | <2.7.17 | 2.7.17 |
| redhat/ansible-engine | <2.7.17 | 2.7.17 |
| redhat/ansible-engine | <2.8.11 | 2.8.11 |
| redhat/ansible-engine | <2.9.7 | 2.9.7 |
| Redhat Ansible Engine | >=2.7.0<2.7.17 | |
| Redhat Ansible Engine | >=2.8.0<2.8.11 | |
| Redhat Ansible Engine | >=2.9.0<2.9.7 | |
| Redhat Ansible Tower | >=3.4.0<=3.4.5 | |
| Redhat Ansible Tower | >=3.5.0<=3.5.5 | |
| Redhat Ansible Tower | >=3.6.0<=3.6.3 | |
| Debian Debian Linux | =10.0 | |
| debian/ansible | 2.7.7+dfsg-1+deb10u1 2.7.7+dfsg-1+deb10u2 2.10.7+merged+base+2.10.8+dfsg-1 7.3.0+dfsg-1 7.7.0+dfsg-3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2020-1746
- https://github.com/ansible/ansible/pull/67866
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1746
- https://www.debian.org/security/2021/dsa-4950
- https://github.com/ansible/ansible/pull/67866/commits/0ff609f1bc5e391fa25710b9a0baaf669f347eb1
- https://github.com/advisories/GHSA-j2h6-73x8-22c4 (Advisory)
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1808472
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1808471
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1808470
- https://access.redhat.com/errata/RHSA-2020:1541
- https://access.redhat.com/errata/RHSA-2020:1542
- https://access.redhat.com/errata/RHSA-2020:1543
- https://access.redhat.com/errata/RHSA-2020:1544
- https://access.redhat.com/security/cve/cve-2020-1746
- https://bugzilla.redhat.com/show_bug.cgi?id=1805491
- https://github.com/ansible/ansible/commit/d41e38435b1a9e300d8011ac28f16a5add2db119
- https://security-tracker.debian.org/tracker/CVE-2020-1746
Frequently Asked Questions
What is CVE-2020-1746?
CVE-2020-1746 is a vulnerability found in the Ansible Engine.
Which versions of Ansible Engine are affected by CVE-2020-1746?
Ansible Engine versions 2.7.x before 2.7.17, 2.8.x before 2.8.11, and 2.9.x before 2.9.7 are affected.
Which Ansible Tower versions are affected by CVE-2020-1746?
Ansible Tower versions 3.4.5, 3.5.5, and 3.6.3 are affected.
What is the severity of CVE-2020-1746?
CVE-2020-1746 has a medium severity.
How can I fix CVE-2020-1746?
To fix CVE-2020-1746, update Ansible Engine to versions 2.7.17, 2.8.11, or 2.9.7.
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/github-advisory
- alias/GHSA-j2h6-73x8-22c4
- alias/CVE-2020-1746
- collector/github-advisory-latest
- collector/nvd-cve
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- collector/security-tracker-debian
- package-manager/pip
- vendor/redhat
- canonical/redhat ansible engine
- version/redhat ansible engine/2.7.0
- version/redhat ansible engine/2.8.0
- version/redhat ansible engine/2.9.0
- canonical/redhat ansible tower
- version/redhat ansible tower/3.4.0
- version/redhat ansible tower/3.4.5
- version/redhat ansible tower/3.5.0
- version/redhat ansible tower/3.5.5
- version/redhat ansible tower/3.6.0
- version/redhat ansible tower/3.6.3
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/10.0
- package-manager/redhat
- package-manager/debian