CVE-2020-10685

🗓️ 11 May 2020 00:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 204 Views

A flaw in Ansible Engine versions 2.7.x before 2.7.17, 2.8.x before 2.8.11, and 2.9.x before 2.9.7, as well as Ansible Tower before version 3.6.3 allows decryption of vault files and leaves sensitive data unencrypted in the temporary directory

Reporter	Title	Published	Views	Family All 84
Tenable Nessus	Amazon Linux 2 : ansible (ALASANSIBLE2-2023-008)	27 Sep 202300:00	–	nessus
Tenable Nessus	Debian DSA-4950-1 : ansible - security update	7 Aug 202100:00	–	nessus
Tenable Nessus	Fedora 30 : ansible (2020-1b6ce91e37)	27 Apr 202000:00	–	nessus
Tenable Nessus	Fedora 31 : ansible (2020-f80154b5b4)	27 Apr 202000:00	–	nessus
Tenable Nessus	GLSA-202006-11 : Ansible: Multiple vulnerabilities	17 Jun 202000:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : ansible (openSUSE-SU-2022:0081-1)	17 Mar 202200:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.9.7) (Important) (RHSA-2020:1541)	22 Apr 202000:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.9.7) (Important) (RHSA-2020:1542)	22 Apr 202000:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Ansible security update (2.8.11) (Important) (RHSA-2020:1543)	22 Apr 202000:00	–	nessus
Tenable Nessus	RHEL 7 : Ansible security update (2.7.17) (Important) (RHSA-2020:1544)	22 Apr 202000:00	–	nessus

NVD

Vulners

Node

redhat ansible_engineRange2.7.0–2.7.17

redhat ansible_engineRange2.8.0–2.8.11

redhat ansible_engineRange2.9.0–2.9.7

redhat ansible_towerRange≤3.4.5

redhat ansible_towerRange3.5.0–3.5.5

redhat ansible_towerRange3.6.0–3.6.3

Node

redhat ceph_storageMatch2.0

redhat ceph_storageMatch3.0

redhat openstackMatch10

redhat openstackMatch13

redhat openstackMatch15

redhat storageMatch3.0

Node

debian debian_linuxMatch10.0

[
  {
    "vendor": "Red Hat",
    "product": "Ansible",
    "versions": [
      {
        "version": "ansible-engine versions 2.7.x before 2.7.17",
        "status": "affected"
      },
      {
        "version": "ansible-engine 2.8.x before 2.8.11",
        "status": "affected"
      },
      {
        "version": "ansible-engine 2.9.x before 2.9.7",
        "status": "affected"
      },
      {
        "version": "Ansible Tower <= 3.4.5",
        "status": "affected"
      },
      {
        "version": "Ansible Tower <= 3.5.5",
        "status": "affected"
      },
      {
        "version": "Ansible Tower <= 3.6.3",
        "status": "affected"
      }
    ]
  }
]

Source	Link
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
security	www.security.gentoo.org/glsa/202006-11
github	www.github.com/ansible/ansible/pull/68433
debian	www.debian.org/security/2021/dsa-4950

21 Nov 2024 04:55Current

5.8Medium risk

Vulners AI Score5.8

CVSS 21.9

CVSS 3.15 - 5.5

EPSS0.00205

CWE-459