nizar-retro's Introduction
nizar-retro's People
nizar-retro's Issues
manila-7.2.0-py2.py3-none-any.whl: 1 vulnerabilities (highest severity is: 8.3)
Vulnerable Library - manila-7.2.0-py2.py3-none-any.whl
Shared Storage for OpenStack
Library home page: https://files.pythonhosted.org/packages/2a/5c/ee41d19bbc89f48d5e0826548f1560b731c49079ea7ce5e98631851b55c4/manila-7.2.0-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in (manila version) | Remediation Possible** | |
---|---|---|---|---|---|---|
CVE-2020-9543 | 8.3 | manila-7.2.0-py2.py3-none-any.whl | Direct | 7.4.1 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2020-9543
Vulnerable Library - manila-7.2.0-py2.py3-none-any.whl
Shared Storage for OpenStack
Library home page: https://files.pythonhosted.org/packages/2a/5c/ee41d19bbc89f48d5e0826548f1560b731c49079ea7ce5e98631851b55c4/manila-7.2.0-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ manila-7.2.0-py2.py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks.
Publish Date: 2020-03-12
URL: CVE-2020-9543
CVSS 3 Score Details (8.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9543
Release Date: 2020-07-14
Fix Resolution: 7.4.1
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
waitress-1.0.2-py2.py3-none-any.whl: 4 vulnerabilities (highest severity is: 7.1)
Vulnerable Library - waitress-1.0.2-py2.py3-none-any.whl
Waitress WSGI server
Library home page: https://files.pythonhosted.org/packages/e7/b6/de07299bbe1b4f43760570b6e2f0468345203b3a037f780626bd1eade2ad/waitress-1.0.2-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in (waitress version) | Remediation Possible** | |
---|---|---|---|---|---|---|
CVE-2019-16792 | 7.1 | waitress-1.0.2-py2.py3-none-any.whl | Direct | 1.4.0 | ✅ | |
CVE-2019-16789 | 7.1 | waitress-1.0.2-py2.py3-none-any.whl | Direct | 1.4.1 | ✅ | |
CVE-2019-16786 | 7.1 | waitress-1.0.2-py2.py3-none-any.whl | Direct | 1.4.0 | ✅ | |
CVE-2019-16785 | 7.1 | waitress-1.0.2-py2.py3-none-any.whl | Direct | 1.4.0 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2019-16792
Vulnerable Library - waitress-1.0.2-py2.py3-none-any.whl
Waitress WSGI server
Library home page: https://files.pythonhosted.org/packages/e7/b6/de07299bbe1b4f43760570b6e2f0468345203b3a037f780626bd1eade2ad/waitress-1.0.2-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ waitress-1.0.2-py2.py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
Waitress through version 1.3.1 allows request smuggling by sending the Content-Length header twice. Waitress would header fold a double Content-Length header and due to being unable to cast the now comma separated value to an integer would set the Content-Length to 0 internally. If two Content-Length headers are sent in a single request, Waitress would treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining. This issue is fixed in Waitress 1.4.0.
Publish Date: 2020-01-22
URL: CVE-2019-16792
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16792
Release Date: 2020-01-22
Fix Resolution: 1.4.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2019-16789
Vulnerable Library - waitress-1.0.2-py2.py3-none-any.whl
Waitress WSGI server
Library home page: https://files.pythonhosted.org/packages/e7/b6/de07299bbe1b4f43760570b6e2f0468345203b3a037f780626bd1eade2ad/waitress-1.0.2-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ waitress-1.0.2-py2.py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
In Waitress through version 1.4.0, if a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling. Specially crafted requests containing special whitespace characters in the Transfer-Encoding header would get parsed by Waitress as being a chunked request, but a front-end server would use the Content-Length instead as the Transfer-Encoding header is considered invalid due to containing invalid characters. If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure. This issue is fixed in Waitress 1.4.1 through more strict HTTP field validation.
Publish Date: 2019-12-26
URL: CVE-2019-16789
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-m5ff-3wj3-8ph4
Release Date: 2019-12-26
Fix Resolution: 1.4.1
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2019-16786
Vulnerable Library - waitress-1.0.2-py2.py3-none-any.whl
Waitress WSGI server
Library home page: https://files.pythonhosted.org/packages/e7/b6/de07299bbe1b4f43760570b6e2f0468345203b3a037f780626bd1eade2ad/waitress-1.0.2-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ waitress-1.0.2-py2.py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
Waitress through version 1.3.1 would parse the Transfer-Encoding header and only look for a single string value, if that value was not chunked it would fall through and use the Content-Length header instead. According to the HTTP standard Transfer-Encoding should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with chunked. Requests sent with: "Transfer-Encoding: gzip, chunked" would incorrectly get ignored, and the request would use a Content-Length header instead to determine the body size of the HTTP message. This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining. This issue is fixed in Waitress 1.4.0.
Publish Date: 2019-12-20
URL: CVE-2019-16786
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-g2xc-35jw-c63p
Release Date: 2019-12-20
Fix Resolution: 1.4.0
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2019-16785
Vulnerable Library - waitress-1.0.2-py2.py3-none-any.whl
Waitress WSGI server
Library home page: https://files.pythonhosted.org/packages/e7/b6/de07299bbe1b4f43760570b6e2f0468345203b3a037f780626bd1eade2ad/waitress-1.0.2-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ waitress-1.0.2-py2.py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
Waitress through version 1.3.1 implemented a "MAY" part of the RFC7230 which states: "Although the line terminator for the start-line and header fields is the sequence CRLF, a recipient MAY recognize a single LF as a line terminator and ignore any preceding CR." Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message. This issue is fixed in Waitress 1.4.0.
Publish Date: 2019-12-20
URL: CVE-2019-16785
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-pg36-wpm5-g57p
Release Date: 2019-12-20
Fix Resolution: 1.4.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
Werkzeug-0.15.2-py2.py3-none-any.whl: 2 vulnerabilities (highest severity is: 7.5)
Vulnerable Library - Werkzeug-0.15.2-py2.py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/18/79/84f02539cc181cdbf5ff5a41b9f52cae870b6f632767e43ba6ac70132e92/Werkzeug-0.15.2-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in (Werkzeug version) | Remediation Possible** | |
---|---|---|---|---|---|---|
CVE-2019-14806 | 7.5 | Werkzeug-0.15.2-py2.py3-none-any.whl | Direct | 0.15.3 | ✅ | |
CVE-2019-14322 | 7.5 | Werkzeug-0.15.2-py2.py3-none-any.whl | Direct | 0.15.5 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2019-14806
Vulnerable Library - Werkzeug-0.15.2-py2.py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/18/79/84f02539cc181cdbf5ff5a41b9f52cae870b6f632767e43ba6ac70132e92/Werkzeug-0.15.2-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ Werkzeug-0.15.2-py2.py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
Pallets Werkzeug before 0.15.3, when used with Docker, has insufficient debugger PIN randomness because Docker containers share the same machine id.
Publish Date: 2019-08-09
URL: CVE-2019-14806
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://palletsprojects.com/blog/werkzeug-0-15-3-released/
Release Date: 2019-08-09
Fix Resolution: 0.15.3
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2019-14322
Vulnerable Library - Werkzeug-0.15.2-py2.py3-none-any.whl
The comprehensive WSGI web application library.
Library home page: https://files.pythonhosted.org/packages/18/79/84f02539cc181cdbf5ff5a41b9f52cae870b6f632767e43ba6ac70132e92/Werkzeug-0.15.2-py2.py3-none-any.whl
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ Werkzeug-0.15.2-py2.py3-none-any.whl (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
In Pallets Werkzeug before 0.15.5, SharedDataMiddleware mishandles drive names (such as C:) in Windows pathnames.
Publish Date: 2019-07-28
URL: CVE-2019-14322
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14322
Release Date: 2019-07-28
Fix Resolution: 0.15.5
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
ansible-2.9.0.tar.gz: 20 vulnerabilities (highest severity is: 7.9)
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in (ansible version) | Remediation Possible** | |
---|---|---|---|---|---|---|
CVE-2020-10684 | 7.9 | ansible-2.9.0.tar.gz | Direct | 2.9.6 | ✅ | |
CVE-2020-1737 | 7.5 | ansible-2.9.0.tar.gz | Direct | 2.9.7 | ✅ | |
CVE-2020-1734 | 7.4 | ansible-2.9.0.tar.gz | Direct | 2.9.6 | ✅ | |
CVE-2019-14904 | 7.3 | ansible-2.9.0.tar.gz | Direct | 2.9.3 | ✅ | |
CVE-2020-14365 | 7.1 | ansible-2.9.0.tar.gz | Direct | 2.9.12 | ✅ | |
CVE-2019-14905 | 5.6 | ansible-2.9.0.tar.gz | Direct | 2.9.3 | ✅ | |
CVE-2020-14332 | 5.5 | ansible-2.9.0.tar.gz | Direct | 2.9.12 | ✅ | |
CVE-2020-10729 | 5.5 | ansible-2.9.0.tar.gz | Direct | 2.9.6 | ✅ | |
CVE-2020-10691 | 5.2 | ansible-2.9.0.tar.gz | Direct | 2.9.8 | ✅ | |
CVE-2020-1753 | 5.0 | ansible-2.9.0.tar.gz | Direct | 2.9.10 | ✅ | |
CVE-2020-1746 | 5.0 | ansible-2.9.0.tar.gz | Direct | 2.9.7 | ✅ | |
CVE-2020-1733 | 5.0 | ansible-2.9.0.tar.gz | Direct | 2.9.6 | ✅ | |
CVE-2020-14330 | 5.0 | ansible-2.9.0.tar.gz | Direct | 2.9.14 | ✅ | |
CVE-2020-10744 | 5.0 | ansible-2.9.0.tar.gz | Direct | 2.9.10 | ✅ | |
CVE-2020-10685 | 5.0 | ansible-2.9.0.tar.gz | Direct | 2.9.7 | ✅ | |
CVE-2020-1735 | 4.2 | ansible-2.9.0.tar.gz | Direct | 2.9.7 | ✅ | |
CVE-2020-1740 | 3.9 | ansible-2.9.0.tar.gz | Direct | 2.9.7 | ✅ | |
CVE-2020-1739 | 3.9 | ansible-2.9.0.tar.gz | Direct | 2.9.6 | ✅ | |
CVE-2020-1738 | 3.9 | ansible-2.9.0.tar.gz | Direct | 2.9.10 | ✅ | |
CVE-2020-1736 | 2.2 | ansible-2.9.0.tar.gz | Direct | 2.9.6 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2020-10684
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
Publish Date: 2020-03-24
URL: CVE-2020-10684
CVSS 3 Score Details (7.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10684
Release Date: 2020-03-24
Fix Resolution: 2.9.6
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-1737
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
Mend Note: After conducting further research, Mend has determined that versions v1.0--v2.7.16, v2.8.0a1--v2.8.10 and v2.9.0b1--v2.9.6 of ansible-engine are vulnerable to CVE-2020-1737
Publish Date: 2020-03-09
URL: CVE-2020-1737
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2020-03-09
Fix Resolution: 2.9.7
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-1734
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.
Publish Date: 2020-03-03
URL: CVE-2020-1734
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-1734
Release Date: 2020-03-03
Fix Resolution: 2.9.6
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2019-14904
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in the solaris_zone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the name of the zone and executing arbitrary commands in the remote host. Ansible Engine 2.7.15, 2.8.7, and 2.9.2 as well as previous versions are affected.
Publish Date: 2020-08-26
URL: CVE-2019-14904
CVSS 3 Score Details (7.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14904
Release Date: 2020-08-26
Fix Resolution: 2.9.3
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-14365
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.
Publish Date: 2020-09-23
URL: CVE-2020-14365
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1869154
Release Date: 2020-09-23
Fix Resolution: 2.9.12
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2019-14905
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.
Publish Date: 2020-03-31
URL: CVE-2019-14905
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Release Date: 2020-03-31
Fix Resolution: 2.9.3
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-14332
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized users to read this data. The highest threat from this vulnerability is to confidentiality.
Publish Date: 2020-09-11
URL: CVE-2020-14332
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14332
Release Date: 2020-09-11
Fix Resolution: 2.9.12
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-10729
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.
Publish Date: 2021-05-27
URL: CVE-2020-10729
CVSS 3 Score Details (5.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10729
Release Date: 2021-05-27
Fix Resolution: 2.9.6
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-10691
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.
Publish Date: 2020-04-30
URL: CVE-2020-10691
CVSS 3 Score Details (5.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Release Date: 2020-05-21
Fix Resolution: 2.9.8
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-1753
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.
Publish Date: 2020-03-16
URL: CVE-2020-1753
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-1753
Release Date: 2020-03-16
Fix Resolution: 2.9.10
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-1746
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.
Publish Date: 2020-05-12
URL: CVE-2020-1746
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1746
Release Date: 2020-05-12
Fix Resolution: 2.9.7
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-1733
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p
"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc//cmdline'.Publish Date: 2020-03-11
URL: CVE-2020-1733
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-1733
Release Date: 2020-03-11
Fix Resolution: 2.9.6
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-14330
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or outputs of performed tasks to read keys used in playbooks from other users within the uri module. The highest threat from this vulnerability is to data confidentiality.
Publish Date: 2020-09-11
URL: CVE-2020-14330
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14330
Release Date: 2020-09-11
Fix Resolution: 2.9.14
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-10744
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
Publish Date: 2020-05-15
URL: CVE-2020-10744
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-10744
Release Date: 2020-05-15
Fix Resolution: 2.9.10
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-10685
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.
Publish Date: 2020-05-11
URL: CVE-2020-10685
CVSS 3 Score Details (5.0)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10685
Release Date: 2020-05-11
Fix Resolution: 2.9.7
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-1735
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Publish Date: 2020-03-16
URL: CVE-2020-1735
CVSS 3 Score Details (4.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1735
Release Date: 2020-03-16
Fix Resolution: 2.9.7
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-1740
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Publish Date: 2020-03-16
URL: CVE-2020-1740
CVSS 3 Score Details (3.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1740
Release Date: 2020-03-16
Fix Resolution: 2.9.7
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-1739
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.
Publish Date: 2020-03-12
URL: CVE-2020-1739
CVSS 3 Score Details (3.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1739
Release Date: 2020-03-12
Fix Resolution: 2.9.6
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-1738
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Publish Date: 2020-03-16
URL: CVE-2020-1738
CVSS 3 Score Details (3.9)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738
Release Date: 2020-03-16
Fix Resolution: 2.9.10
⛑️ Automatic Remediation will be attempted for this issue.
CVE-2020-1736
Vulnerable Library - ansible-2.9.0.tar.gz
Radically simple IT automation
Library home page: https://files.pythonhosted.org/packages/59/3a/5b8aeca9b0b68e7a02fdfd7260f265be3b0605839d7367501aba4bcb2e14/ansible-2.9.0.tar.gz
Path to dependency file: /requirements.txt
Path to vulnerable library: /requirements.txt
Dependency Hierarchy:
- ❌ ansible-2.9.0.tar.gz (Vulnerable Library)
Found in HEAD commit: 8526e43cddf7a6c6a0443438383ec5fc1462dce1
Found in base branch: main
Vulnerability Details
A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Publish Date: 2020-03-16
URL: CVE-2020-1736
CVSS 3 Score Details (2.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: High
- Privileges Required: Low
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-1736
Release Date: 2020-03-16
Fix Resolution: 2.9.6
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.