PYSEC-2020-221
A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers.
Not rated yet
Withdrawn May 30, 2023
PyPI
- Severity
- Not rated yet
- No source has published a CVSS score yet
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
- None yet
- No fixed version published
Description
A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service availability.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| ansible | all versions |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
References
Issue reports
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-8ggh-xwr9-3373 Ansible Community General Collection is vulnerable to exposure of sensitive information | Medium | Also affects ansible |
| GHSA-jpvw-p8pr-9g2x Ansible symlink attack vulnerability | Medium | Also affects ansible |
| GHSA-cpx3-93w7-457x Ansible leaks password to logs | High | Also affects ansible |
| GHSA-fh5v-5f35-2rv2 Insertion of Sensitive Information into Log File in ansible | Medium | Also affects ansible |
| GHSA-4r65-35qq-ch8j Ansible discloses sensitive information in traceback error message | Medium | Also affects ansible |
| GHSA-2pfh-q76x-gwvm Improper Input Validation and Command Injection in Ansible | High | Also affects ansible |
| PYSEC-2021-126 A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory. | Not rated yet | Also affects ansible |
| GHSA-r6h7-5pq2-j77h Insufficiently random values in Ansible | Medium | Also affects ansible |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor