CVE-2020-1739
3.9
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Exploitability: 1.3 / Impact: 2.5
Source: NVD
Description
A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.
Affected (14)
Products: Redhat: Ansible, Ansible Tower, Cloudforms Management Engine, Openstack · Fedoraproject: Fedora · Debian: Debian Linux
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 2.7.16 | |
| Up to 3.3.4 |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Version 5.0 | |
| Version 13 |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Version 30 |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| Version 10.0 |
References (14)
Source: secalert@redhat.com
Issue TrackingPatchThird Party Advisory
Source: secalert@redhat.com
Issue TrackingThird Party Advisory
Source: secalert@redhat.com
Mailing ListThird Party Advisory
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: secalert@redhat.com
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Timeline
No history available yet.