Vulnerability Description
A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Ansible | <= 2.7.16 |
| Redhat | Ansible Tower | <= 3.3.4 |
| Redhat | Cloudforms Management Engine | 5.0 |
| Redhat | Openstack | 13 |
| Fedoraproject | Fedora | 30 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739Issue TrackingPatchThird Party Advisory
- https://github.com/ansible/ansible/issues/67797Issue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/05/msg00005.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.debian.org/security/2021/dsa-4950Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739Issue TrackingPatchThird Party Advisory
- https://github.com/ansible/ansible/issues/67797Issue TrackingThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/05/msg00005.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.debian.org/security/2021/dsa-4950Third Party Advisory
FAQ
What is CVE-2020-1739?
CVE-2020-1739 is a vulnerability with a CVSS score of 3.9 (LOW). A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to othe...
How severe is CVE-2020-1739?
CVE-2020-1739 has been rated LOW with a CVSS base score of 3.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-1739?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Ansible, Redhat Ansible Tower, Redhat Cloudforms Management Engine, Redhat Openstack, Fedoraproject Fedora.