SB2020061518 - Gentoo update for Ansible
Published: June 15, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Code Injection (CVE-ID: CVE-2020-10684)
The vulnerability allows a local user to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation when using "ansible_facts" as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the "ansible_facts" after the clean. A local user can alter the "ansible_facts", such as "ansible_hosts", "users" and any other key data which would lead into privilege escalation or code injection
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
2) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2020-10685)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists in Ansible Engine when using modules which decrypts vault files such as "assemble", "script", "unarchive", "win_copy", "aws_s3" or "copy modules". A local user can gain unathorized access to sensitive information on the target system.
3) Race condition (CVE-ID: CVE-2020-1733)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition when running a playbook with an unprivileged become user. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
4) Path traversal (CVE-ID: CVE-2020-1735)
The vulnerability allows a local user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A local administrator can intercept the module, inject a new path, and then choose a new destination path on the controller node.
5) Incorrect permission assignment for critical resource (CVE-ID: CVE-2020-1736)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists when a file is moved using "atomic_move" primitive as the file mode cannot be specified. A local user can gain unauthorized access to sensitive information on the system.
6) Path traversal (CVE-ID: CVE-2020-1737)
The vulnerability allows a local user to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences within the "Extract-Zip" function from the "win_unzip" module. A local user can send a specially crafted HTTP request and read arbitrary files on the system.
7) Improper Neutralization of Argument Delimiters in a Command (CVE-ID: CVE-2020-1738)
The vulnerability allows a local user to compromise the target system.
The vulnerability exists when the module package or service is used and the parameter "use" is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file.
8) Information disclosure (CVE-ID: CVE-2020-1740)
The vulnerability allows a local user to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application when using Ansible Vault for editing encrypted files. A local user can gain unauthorized access to sensitive information on the system.
9) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2020-1753)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software stores sensitive information into log files when managing Kubernetes using the k8s connection plugin. A local user can read the log files and gain access to sensitive data.
Remediation
Install update from vendor's website.