CVE-2020-14365 (High) detected in ansible-2.9.9.tar.gz

[staging-whitesource-for-github-com[bot]]

CVE-2020-14365 - High Severity Vulnerability

Vulnerable Library - ansible-2.9.9.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/00/5d/e10b83e0e6056dbd5b4809b451a191395175a57e3175ce04e35d9c5fc2a0/ansible-2.9.9.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy: - :x: **ansible-2.9.9.tar.gz** (Vulnerable Library)

Found in HEAD commit: d06fd72409365ba316e938b85785276377dc0eb1

Found in base branch: main

Vulnerability Details

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

Publish Date: 2020-09-23

URL: CVE-2020-14365

CVSS 3 Score Details (7.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1869154

Release Date: 2020-09-23

Fix Resolution: 2.9.12

---

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.