Skip to content
Log inStart free trial

GHSA-m429-fhmv-c6q2 CVE-2020-14365 PYSEC-2020-209

Improper Verification of Cryptographic Signature in ansible

High PyPI
Severity
0.0 / 10
High · CVSS 4.0
Exploit chance (EPSS)
0.23%
Chance of exploitation in the next 30 days. Higher than 14.24% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-347 Improper Verification of Cryptographic Signature
Fix
2.8.15
Upgrade ansible to this version or later

Description

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

Affected versions

PyPI

PackageVulnerableFixed in
ansible
>= 2.8.0a1, < 2.8.15
2.8.15
ansible
>= 2.9.0a1, < 2.9.13
2.9.13
ansible
>= 2.8.0, < 2.8.16rc1
>= 2.9.0, < 2.9.14rc1
2.8.16rc1
2.9.14rc1

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

ansible PyPI → 2.8.15

pip
pip install --upgrade "ansible>=2.8.15"
poetry
poetry add "ansible>=2.8.15"
uv
uv add "ansible>=2.8.15"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Attack vector
Local
Attack complexity
Low
Attack requirements
None
Privileges required
Low
User interaction
None
Confidentiality (vulnerable system)
None
Integrity (vulnerable system)
High
Availability (vulnerable system)
High
Confidentiality (subsequent systems)
None
Integrity (subsequent systems)
None
Availability (subsequent systems)
None

CVSS 3.1 7.1

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack vector
Local
Attack complexity
Low
Privileges required
Low
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Weakness

CWE-347: Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-8ggh-xwr9-3373
Ansible Community General Collection is vulnerable to exposure of sensitive information
Medium Also affects ansible
GHSA-jpvw-p8pr-9g2x
Ansible symlink attack vulnerability
Medium Also affects ansible
GHSA-cpx3-93w7-457x
Ansible leaks password to logs
High Also affects ansible
GHSA-fh5v-5f35-2rv2
Insertion of Sensitive Information into Log File in ansible
Medium Also affects ansible
GHSA-4r65-35qq-ch8j
Ansible discloses sensitive information in traceback error message
Medium Also affects ansible
GHSA-2pfh-q76x-gwvm
Improper Input Validation and Command Injection in Ansible
High Also affects ansible
PYSEC-2021-126
A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory.
Not rated yet Also affects ansible
GHSA-r6h7-5pq2-j77h
Insufficiently random values in Ansible
Medium Also affects ansible
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor