CVE-2020-14365 (High) detected in ansible-2.9.9.tar.gz

[staging-whitesource-for-github-com[bot]]

CVE-2020-14365 - High Severity Vulnerability

Vulnerable Library - ansible-2.9.9.tar.gz

Radically simple IT automation

Library home page: https://files.pythonhosted.org/packages/00/5d/e10b83e0e6056dbd5b4809b451a191395175a57e3175ce04e35d9c5fc2a0/ansible-2.9.9.tar.gz

Path to dependency file: /requirements.txt

Path to vulnerable library: /tmp/ws-ua_20241118235438_XGTZEX/python_EPWBVT/202411182354391/env/lib/python3.8/site-packages/ansible-2.9.9.dist-info

Dependency Hierarchy: - :x: **ansible-2.9.9.tar.gz** (Vulnerable Library)

Found in HEAD commit: 0a1c456c5c33335bd74e0019d6b21169a177e1d2

Found in base branch: main

Vulnerability Details

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

Publish Date: 2020-09-23

URL: CVE-2020-14365

CVSS 3 Score Details (7.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1869154

Release Date: 2020-09-23

Fix Resolution: 2.9.12

---

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.