Vulnerable Library - manila-7.2.0-py2.py3-none-any.whl

Shared Storage for OpenStack

Library home page: https://files.pythonhosted.org/packages/2a/5c/ee41d19bbc89f48d5e0826548f1560b731c49079ea7ce5e98631851b55c4/manila-7.2.0-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

CVE-2020-9543

Vulnerable Library - manila-7.2.0-py2.py3-none-any.whl

Shared Storage for OpenStack

Library home page: https://files.pythonhosted.org/packages/2a/5c/ee41d19bbc89f48d5e0826548f1560b731c49079ea7ce5e98631851b55c4/manila-7.2.0-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ manila-7.2.0-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks.

Publish Date: 2020-03-12

URL: CVE-2020-9543

CVSS 3 Score Details (8.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9543

Release Date: 2020-07-14

Fix Resolution: 7.4.1

⛑️ Automatic Remediation will be attempted for this issue.

Vulnerable Library - waitress-1.0.2-py2.py3-none-any.whl

Waitress WSGI server

Library home page: https://files.pythonhosted.org/packages/e7/b6/de07299bbe1b4f43760570b6e2f0468345203b3a037f780626bd1eade2ad/waitress-1.0.2-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

CVE-2019-16792

Vulnerable Library - waitress-1.0.2-py2.py3-none-any.whl

Waitress WSGI server

Library home page: https://files.pythonhosted.org/packages/e7/b6/de07299bbe1b4f43760570b6e2f0468345203b3a037f780626bd1eade2ad/waitress-1.0.2-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ waitress-1.0.2-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.

Publish Date: 2020-01-22

URL: CVE-2019-16792

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16792

Release Date: 2020-01-22

Fix Resolution: 1.4.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-16789

Vulnerable Library - waitress-1.0.2-py2.py3-none-any.whl

Waitress WSGI server

Library home page: https://files.pythonhosted.org/packages/e7/b6/de07299bbe1b4f43760570b6e2f0468345203b3a037f780626bd1eade2ad/waitress-1.0.2-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ waitress-1.0.2-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.

Publish Date: 2019-12-26

URL: CVE-2019-16789

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-m5ff-3wj3-8ph4

Release Date: 2019-12-26

Fix Resolution: 1.4.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-16786

Vulnerable Library - waitress-1.0.2-py2.py3-none-any.whl

Waitress WSGI server

Library home page: https://files.pythonhosted.org/packages/e7/b6/de07299bbe1b4f43760570b6e2f0468345203b3a037f780626bd1eade2ad/waitress-1.0.2-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ waitress-1.0.2-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.

Publish Date: 2019-12-20

URL: CVE-2019-16786

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-g2xc-35jw-c63p

Release Date: 2019-12-20

Fix Resolution: 1.4.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-16785

Vulnerable Library - waitress-1.0.2-py2.py3-none-any.whl

Waitress WSGI server

Library home page: https://files.pythonhosted.org/packages/e7/b6/de07299bbe1b4f43760570b6e2f0468345203b3a037f780626bd1eade2ad/waitress-1.0.2-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ waitress-1.0.2-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.

Publish Date: 2019-12-20

URL: CVE-2019-16785

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: GHSA-pg36-wpm5-g57p

Release Date: 2019-12-20

Fix Resolution: 1.4.0

⛑️ Automatic Remediation will be attempted for this issue.

Vulnerable Library - Werkzeug-0.15.2-py2.py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/18/79/84f02539cc181cdbf5ff5a41b9f52cae870b6f632767e43ba6ac70132e92/Werkzeug-0.15.2-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

CVE-2019-14806

Vulnerable Library - Werkzeug-0.15.2-py2.py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/18/79/84f02539cc181cdbf5ff5a41b9f52cae870b6f632767e43ba6ac70132e92/Werkzeug-0.15.2-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ Werkzeug-0.15.2-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.

Publish Date: 2019-08-09

URL: CVE-2019-14806

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://palletsprojects.com/blog/werkzeug-0-15-3-released/

Release Date: 2019-08-09

Fix Resolution: 0.15.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-14322

Vulnerable Library - Werkzeug-0.15.2-py2.py3-none-any.whl

The comprehensive WSGI web application library.

Library home page: https://files.pythonhosted.org/packages/18/79/84f02539cc181cdbf5ff5a41b9f52cae870b6f632767e43ba6ac70132e92/Werkzeug-0.15.2-py2.py3-none-any.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ Werkzeug-0.15.2-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.

Publish Date: 2019-07-28

URL: CVE-2019-14322

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14322

Release Date: 2019-07-28

Fix Resolution: 0.15.5

⛑️ Automatic Remediation will be attempted for this issue.

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

CVE-2020-10684

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.

Publish Date: 2020-03-24

URL: CVE-2020-10684

CVSS 3 Score Details (7.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10684

Release Date: 2020-03-24

Fix Resolution: 2.9.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-1737

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
Mend Note: After conducting further research, Mend has determined that versions v1.0--v2.7.16, v2.8.0a1--v2.8.10 and v2.9.0b1--v2.9.6 of ansible-engine are vulnerable to CVE-2020-1737

Publish Date: 2020-03-09

URL: CVE-2020-1737

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-09

Fix Resolution: 2.9.7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-1734

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.

Publish Date: 2020-03-03

URL: CVE-2020-1734

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-1734

Release Date: 2020-03-03

Fix Resolution: 2.9.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-14904

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.

Publish Date: 2020-08-26

URL: CVE-2019-14904

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14904

Release Date: 2020-08-26

Fix Resolution: 2.9.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-14365

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

Publish Date: 2020-09-23

URL: CVE-2020-14365

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1869154

Release Date: 2020-09-23

Fix Resolution: 2.9.12

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-14905

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.

Publish Date: 2020-03-31

URL: CVE-2019-14905

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-31

Fix Resolution: 2.9.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-14332

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.

Publish Date: 2020-09-11

URL: CVE-2020-14332

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14332

Release Date: 2020-09-11

Fix Resolution: 2.9.12

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-10729

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.

Publish Date: 2021-05-27

URL: CVE-2020-10729

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10729

Release Date: 2021-05-27

Fix Resolution: 2.9.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-10691

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

Publish Date: 2020-04-30

URL: CVE-2020-10691

CVSS 3 Score Details (5.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Release Date: 2020-05-21

Fix Resolution: 2.9.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-1753

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.

Publish Date: 2020-03-16

URL: CVE-2020-1753

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-1753

Release Date: 2020-03-16

Fix Resolution: 2.9.10

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-1746

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.

Publish Date: 2020-05-12

URL: CVE-2020-1746

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1746

Release Date: 2020-05-12

Fix Resolution: 2.9.7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-1733

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p

Publish Date: 2020-03-11

URL: CVE-2020-1733

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-1733

Release Date: 2020-03-11

Fix Resolution: 2.9.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-14330

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.

Publish Date: 2020-09-11

URL: CVE-2020-14330

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14330

Release Date: 2020-09-11

Fix Resolution: 2.9.14

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-10744

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.

Publish Date: 2020-05-15

URL: CVE-2020-10744

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-10744

Release Date: 2020-05-15

Fix Resolution: 2.9.10

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-10685

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.

Publish Date: 2020-05-11

URL: CVE-2020-10685

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10685

Release Date: 2020-05-11

Fix Resolution: 2.9.7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-1735

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Publish Date: 2020-03-16

URL: CVE-2020-1735

CVSS 3 Score Details (4.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1735

Release Date: 2020-03-16

Fix Resolution: 2.9.7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-1740

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Publish Date: 2020-03-16

URL: CVE-2020-1740

CVSS 3 Score Details (3.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1740

Release Date: 2020-03-16

Fix Resolution: 2.9.7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-1739

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.

Publish Date: 2020-03-12

URL: CVE-2020-1739

CVSS 3 Score Details (3.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1739

Release Date: 2020-03-12

Fix Resolution: 2.9.6

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-1738

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Publish Date: 2020-03-16

URL: CVE-2020-1738

CVSS 3 Score Details (3.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738

Release Date: 2020-03-16

Fix Resolution: 2.9.10

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-1736

Vulnerable Library - ansible-2.9.0.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• ❌ ansible-2.9.0.tar.gz (Vulnerable Library)

Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1

Found in base branch: main

Vulnerability Details

A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Publish Date: 2020-03-16

URL: CVE-2020-1736

CVSS 3 Score Details (2.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-1736

Release Date: 2020-03-16

Fix Resolution: 2.9.6

⛑️ Automatic Remediation will be attempted for this issue.