Bug 1802178 (CVE-2020-1739) - CVE-2020-1739 ansible: svn module leaks password when specified as a parameter
Summary: CVE-2020-1739 ansible: svn module leaks password when specified as a parameter
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-1739
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1807432 1814785 1804378 1804379 1804380 1804381 1805321 1805322 1805377 1805378 1805379 1805380 1805520 1807879
Blocks: 1801714
TreeView+ depends on / blocked
 
Reported: 2020-02-12 14:22 UTC by Borja Tarraso
Modified: 2020-05-27 05:33 UTC (History)
38 users (show)

Fixed In Version: ansible-engine 2.7.17, ansible-engine 2.8.11, ansible-engine 2.9.7
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in Ansible Engine. When a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.
Clone Of:
Environment:
Last Closed: 2020-04-22 16:32:01 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:2150 None None None 2020-05-14 11:25:11 UTC
Red Hat Product Errata RHBA-2020:2251 None None None 2020-05-21 19:05:04 UTC
Red Hat Product Errata RHSA-2020:1541 None None None 2020-04-22 14:09:21 UTC
Red Hat Product Errata RHSA-2020:1542 None None None 2020-04-22 14:09:39 UTC
Red Hat Product Errata RHSA-2020:1543 None None None 2020-04-22 14:09:57 UTC
Red Hat Product Errata RHSA-2020:1544 None None None 2020-04-22 14:10:16 UTC

Description Borja Tarraso 2020-02-12 14:22:03 UTC
When a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node.

Comment 2 Borja Tarraso 2020-02-17 12:57:17 UTC
Acknowledgments:

Name: Damien Aumaitre (Quarkslab), Nicolas Surbayrole (Quarkslab)

Comment 4 Salvatore Bonaccorso 2020-02-19 07:16:28 UTC
Is there are related upstream issue?

Comment 5 Borja Tarraso 2020-02-20 16:40:51 UTC
Created ansible tracking bugs for this issue:

Affects: epel-all [bug 1805322]
Affects: fedora-all [bug 1805321]

Comment 6 Borja Tarraso 2020-02-20 17:01:40 UTC
Hey Salvatore, I am working to provide additional information regarding this issue; more details as you requested, affected versions as well as upstream links in case we already have. Prioritising this for now, I will get back to you asap.

In reply to comment #4:
> Is there are related upstream issue?

Comment 9 Yadnyawalk Tale 2020-02-20 22:45:06 UTC
Red Hat CloudForms Management Engine 5.9 is in maintenance phase and we're no longer fixing "Low" severity CVEs.

Comment 12 Borja Tarraso 2020-02-25 14:58:46 UTC
Mitigation:

Instead of using the parameter 'password' of the subversion module, provide the password with stdin.

Comment 14 Borja Tarraso 2020-02-27 10:19:57 UTC
Upstream fix: https://github.com/ansible/ansible/issues/67797

Comment 15 Borja Tarraso 2020-02-27 12:19:34 UTC
Created ansible tracking bugs for this issue:

Affects: openstack-rdo [bug 1807879]

Comment 16 Hardik Vyas 2020-03-18 16:24:35 UTC
Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains its own version of Ansible. The fix will be provided from core Ansible. But we still ship ansible separately for ceph ubuntu.

Comment 18 Borja Tarraso 2020-03-27 07:27:41 UTC
Statement:

Ansible Engine 2.7.16, 2.8.10, and 2.9.6 as well as previous versions are affected.

Ansible Tower 3.4.5, 3.5.5 and 3.6.3 as well as previous versions are affected.

Comment 19 errata-xmlrpc 2020-04-22 14:09:19 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2.9 for RHEL 7
  Red Hat Ansible Engine 2.9 for RHEL 8

Via RHSA-2020:1541 https://access.redhat.com/errata/RHSA-2020:1541

Comment 20 errata-xmlrpc 2020-04-22 14:09:37 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2 for RHEL 7
  Red Hat Ansible Engine 2 for RHEL 8

Via RHSA-2020:1542 https://access.redhat.com/errata/RHSA-2020:1542

Comment 21 errata-xmlrpc 2020-04-22 14:09:55 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2.8 for RHEL 7
  Red Hat Ansible Engine 2.8 for RHEL 8

Via RHSA-2020:1543 https://access.redhat.com/errata/RHSA-2020:1543

Comment 22 errata-xmlrpc 2020-04-22 14:10:13 UTC
This issue has been addressed in the following products:

  Red Hat Ansible Engine 2.7 for RHEL 7

Via RHSA-2020:1544 https://access.redhat.com/errata/RHSA-2020:1544

Comment 23 Product Security DevOps Team 2020-04-22 16:32:01 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-1739

Comment 24 Yadnyawalk Tale 2020-05-11 09:46:42 UTC
CloudForms 5.11 do not use ansible-tower and 5.10 only using ansible-tower-venv-ansible atm.


Note You need to log in before you can comment on or make changes to this bug.