CVE-2020-10729
lowPriorität · verfolgen · 22OT-Risiko · erhöhtEPSS 0.004 · 38. PerzentilDEEURUUSEPSS · bewertet 2026-10-27
A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- Behobenansible-0:2.9.6-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 7 Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHBA-2020:0784 - Behobenansible-0:2.9.6-1.el7ae.src as a component of Red Hat Ansible Engine 2.9 for RHEL 7 Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHBA-2020:0784 - Behobenansible-0:2.9.6-1.el8ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 8redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHBA-2020:0784 - Behobenansible-0:2.9.6-1.el8ae.src as a component of Red Hat Ansible Engine 2.9 for RHEL 8redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHBA-2020:0784 - Behobenansible-test-0:2.9.6-1.el7ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 7 Serverredhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHBA-2020:0784 - Behobenansible-test-0:2.9.6-1.el8ae.noarch as a component of Red Hat Ansible Engine 2.9 for RHEL 8redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHBA-2020:0784
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · low–medium · 2.1–5.5
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (23)
Betroffene Produkte und Versionsbereiche.
Advisories (4)
Hersteller- und Ökosystem-Meldungen dazu.
- RHBA-2020:0784Red Hat Bug Fix Advisory: Ansible 2.9.6 release for Ansible Engine 2.92020-03-11csaf · redhat_csafUS
Ansible 2.9.6 release for Ansible Engine 2.9
- WID-SEC-W-2024-3588Ansible: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2021-06-07csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in Ansible ausnutzen, um Informationen offenzulegen.
- GHSA-r6h7-5pq2-j77hInsufficiently random values in Ansible2021-06-15ghsa · osvUS
A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.
- PYSEC-2021-1052021-05-27vendor · osvUS
A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.
auch bekannt als (7)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (12)
Externe Belege — Patches, Meldungen, Analysen.
- https://bugzilla.redhat.com/show_bug.cgi?id=1831089cnnvd
- https://github.com/ansible/ansible/issues/34144cnnvd
- https://vigilance.fr/vulnerability/Ansible-information-disclosure-via-Random-Password-Lookups-35563cnnvd
- https://www.auscert.org.au/bulletins/ESB-2021.2663cnnvd
- https://www.cybersecurity-help.cz/vdb/SB2021080804cnnvd
- https://www.debian.org/security/2021/dsa-4950cnnvd
- https://bugzilla.redhat.com/show_bug.cgi?id=1831089enisa_euvd
- https://github.com/ansible/ansible/issues/34144enisa_euvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan