CVE-2020-14365 (High) detected in ansible-2.9.9.tar.gz

[staging-whitesource-for-github-com[bot]]

CVE-2020-14365 - High Severity Vulnerability

Vulnerable Library - ansible-2.9.9.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/00/5d/e10b83e0e6056dbd5b4809b451a191395175a57e3175ce04e35d9c5fc2a0/ansible-2.9.9.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - :x: **ansible-2.9.9.tar.gz** (Vulnerable Library)

Found in HEAD commit: 98052fa92a99c4d50714f167a113b4f08fbcb374

Found in base branch: main

Vulnerability Details

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

Publish Date: 2020-09-23

URL: CVE-2020-14365

CVSS 3 Score Details (7.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1869154

Release Date: 2020-09-23

Fix Resolution: 2.9.12

---

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.