CVE-2020-14365

mediumpriority · track · 28EPSS 0.002 · 14 %ileDEEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.23% (14th) EPSS
CVSS 6.6 · medium
Is it mine?
35 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · osv

EPSS · scored 2026-10-27

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

01

cvss

Technical severity, 0–10. One row per scoring source.

7.1
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.5–7.1

v2.06.6mediumAV:L/AC:L/Au:N/C:N/I:C/A:Cprimary · NVD / NIST USexploitability 3.9 · impact 9.2
v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.2
v3.17.1highAV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:Hsecondary · OSV
v3.16.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
02

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-347USCWE-347USCWE-347US
03

affected products (35)

Products and version ranges known to be affected.

showing 20 of 35
04

advisories (3)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2023-2469Ansible: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2020-09-01csaf · cert_bundDE

    Ein lokaler Angreifer kann eine Schwachstelle in Ansible und Ansible Tower ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

  • GHSA-m429-fhmv-c6q2Improper Verification of Cryptographic Signature in ansible2021-04-20ghsa · osvUS

    A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when `disable_gpg_check` is set to `False`, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

  • PYSEC-2020-2092020-09-23vendor · osvUS

    A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

05

also known as (7)

Other names and identifiers for this entity.

06

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bduosvcert_bundNVDCVE.orgMITRE
published 2020-09-23modified 2026-06-17
07

references (19)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan