Exposure of Sensitive Information to an Unauthorized Actor in Ansible
A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-1739US | low3.9 | — | ||
A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739WEB
- https://github.com/advisories/GHSA-923p-fr2c-g5m2ADVISORY
- https://github.com/ansible/ansiblePACKAGE
- https://github.com/ansible/ansible/commit/1a89d4f059c21a818306a39ada7f5284ae125237WEB
- https://github.com/ansible/ansible/commit/6c74a298702c8bb5532b9600073312e08f39680fWEB
- https://github.com/ansible/ansible/commit/c6c4fbf4a1fdea1e10ba94462a60c413990a16a4WEB
- https://github.com/ansible/ansible/issues/67797WEB
- https://github.com/ansible/ansible/pull/68911WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan