PYSEC-2020-206: Command Injection

Q: Which deployments are affected?

Affected releases are Ansible Engine 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16, and earlier releases. The issue is specific to use of the nxos_file_copy module for copying files to flash or bootflash on NXOS devices.

Q: What access does an attacker need to exploit this issue?

The supplied severity vector identifies the attack as local and requiring high privileges, with no user interaction required. Exploitation involves crafting the module's filename parameter to inject OS commands.

Q: How can I determine whether I am affected?

Check the installed Ansible Engine version and whether your automation uses nxos_file_copy. Versions below 2.9.3 in the 2.9 branch, below 2.8.8 in the 2.8 branch, below 2.7.16 in the 2.7 branch, or earlier releases are affected.

Published Mar 31, 2020

Updated

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxosfilecopy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

Affected Software

1 affected component

Ansible Ansible Engine>=2.9.0<2.9.3, >=2.8.0<2.8.8, <2.7.16

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ansible Engine to a version that resolves this vulnerability.
Fixed in 2.9.3
Upgrade
Upgrade Ansible Engine to a version that resolves this vulnerability.
Fixed in 2.8.8
Upgrade
Upgrade Ansible Engine to a version that resolves this vulnerability.
Fixed in 2.7.16

Event History

Mar 31, 2020

CVE Published

via OSV·05:15 PM

Data Sourced

via OSV·05:15 PM

DescriptionSeverity

Frequently Asked Questions

Which deployments are affected?

Affected releases are Ansible Engine 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16, and earlier releases. The issue is specific to use of the nxos_file_copy module for copying files to flash or bootflash on NXOS devices.

What access does an attacker need to exploit this issue?

The supplied severity vector identifies the attack as local and requiring high privileges, with no user interaction required. Exploitation involves crafting the module's filename parameter to inject OS commands.

How can I determine whether I am affected?

Check the installed Ansible Engine version and whether your automation uses nxos_file_copy. Versions below 2.9.3 in the 2.9 branch, below 2.8.8 in the 2.8 branch, below 2.7.16 in the 2.7 branch, or earlier releases are affected.

PYSEC-2020-206: Command Injection

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

How can I determine whether I am affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What access does an attacker need to exploit this issue?

How can I determine whether I am affected?