Bug 1815519 (CVE-2020-10684)
| Summary: | CVE-2020-10684 Ansible: code injection when using ansible_facts as a subkey | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Borja Tarraso <btarraso> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | a.badger, amctagga, anharris, bcoca, bniver, carnil, cmeyers, dbecker, flucifre, gblomqui, gmainwar, gmeno, hvyas, jcammara, jjoyce, jschluet, jtanner, kbasil, kevin, lhh, lpeer, mabashia, maxim, mbenjamin, mburns, mhackett, notting, puebele, rhos-maint, rpetrell, sclewis, sdoran, security-response-team, slinaber, smcdonal, tkuratom, tvignaud, vbellur, vereddy |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | ansible-engine 2.7.17, ansible-engine 2.8.11, ansible-engine 2.9.7 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the Ansible Engine. When using ansible_facts as a subkey of itself, and promoting it to a variable when injecting is enabled, overwriting the ansible_facts after the clean, an attacker could take advantage of this by altering the ansible_facts leading to privilege escalation or code injection. The highest threat from this vulnerability are to data integrity and system availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-04-22 16:32:25 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1816309, 1816310, 1816311, 1816316, 1816317, 1816318, 1816319, 1816320, 1816321, 1816322, 1816455, 1816456, 1819553 | ||
| Bug Blocks: | 1815527 | ||
|
Description
Borja Tarraso
2020-03-20 13:49:40 UTC
Acknowledgments: Name: Damien Aumaitre (Quarkslab), Nicolas Surbayrole (Quarkslab) Mitigation: Currently, there is not a known mitigation except avoiding the functionality of using ansible_facts as a subkey. I am confused by that statement. Ansible Tower also does not maintain its own version of Ansible. Created ansible tracking bugs for this issue: Affects: openstack-rdo [bug 1816309] Created ansible tracking bugs for this issue: Affects: epel-all [bug 1816311] Affects: fedora-all [bug 1816310] Hi Borja, Sorry for beeing annoying again. Once reported upstream can you reference the upstream issue here as well? Regards, Salvatore Removing CloudForms from affect list. CloudForms 5.10 & 5.11 both subscribe to Ansible repos, so we do not need to include cfme5/ansible-tower in affects nor file trackers. ansible_engine/ansible_tower affects entries are sufficient to inform Cloudforms customers. Hi Salvatore, here is the upstream fix: https://github.com/ansible/ansible/pull/68431 This issue has been addressed in the following products: Red Hat Ansible Engine 2.9 for RHEL 7 Red Hat Ansible Engine 2.9 for RHEL 8 Via RHSA-2020:1541 https://access.redhat.com/errata/RHSA-2020:1541 This issue has been addressed in the following products: Red Hat Ansible Engine 2 for RHEL 7 Red Hat Ansible Engine 2 for RHEL 8 Via RHSA-2020:1542 https://access.redhat.com/errata/RHSA-2020:1542 This issue has been addressed in the following products: Red Hat Ansible Engine 2.8 for RHEL 7 Red Hat Ansible Engine 2.8 for RHEL 8 Via RHSA-2020:1543 https://access.redhat.com/errata/RHSA-2020:1543 This issue has been addressed in the following products: Red Hat Ansible Engine 2.7 for RHEL 7 Via RHSA-2020:1544 https://access.redhat.com/errata/RHSA-2020:1544 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-10684 Statement: * Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected. * Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected. * Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains their own version of Ansible. The fix will be consumed from core Ansible. But we still ship ansible separately for ceph ubuntu. * Red Hat OpenStack Platform does package the affected code. However, because RHOSP does not use ansible_facts as a subkey directly, the RHOSP impact has been reduced to Moderate and no update will be provided at this time for the RHOSP ansible package. |