Homepage
About Snyk

Information Exposure Affecting ansible package, versions [2.7.0,2.7.17) [2.8.0a1,2.8.11) [2.9.0b1,2.9.7)

0.0
low

Snyk CVSS

    Attack Complexity High

    Threat Intelligence

    EPSS 0.05% (15th percentile)
Expand this section
NVD
3.9 low
Expand this section
Red Hat
3.9 low

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-PYTHON-ANSIBLE-560128
  • published 12 Mar 2020
  • disclosed 12 Mar 2020
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 12 Mar 2020

CVE-2020-1739 Open this link in a new tab
CWE-200 Open this link in a new tab

How to fix?

Upgrade ansible to version 2.7.17, 2.8.11, 2.9.7 or higher.

Overview

ansible is a simple IT automation system.

Affected versions of this package are vulnerable to Information Exposure. When a password is set with the argument password of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.