CVE-2020-10684: debian debian_linux Improper Control of Generation of Code
Vulnerability summary
CVE-2020-10684 is a high (CVSS 7.9) Improper Control of Generation of Code vulnerability in debian debian_linux. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 26.3% of scored vulnerabilities.
Not severe (CVSS 7.9, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 7Timeline
- 24-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
CVSS metrics
7 scores · 5 sources · 3 versions- OSV · PypiEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HDiffers
- OSV · DebianEcosystem advisory · calculated7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HDiffers
- NVDNIST7.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:HDiffers
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.33% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of CodeThe product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
- CWE-862Missing AuthorizationThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected systems
Known conditions: local access, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat3 products
- ansible≥ 2.7.0, < 2.7.17 | ≥ 2.8.0, < 2.8.9 | ≥ 2.9.0, < 2.9.6
- ansible_tower≤ 3.3.5 | ≥ 3.5.0, ≤ 3.5.5 | ≥ 3.6.0, ≤ 3.6.3
- openstack10 | 13
Debian2 products
- ansible< 2.9.7+dfsg-1
- debian_linuxEOL10.0
Fedoraproject1 product
- fedoraEOL30 | 31 | 32
PyPI1 product
- ansible≥ 2.7.0a1, < 2.7.17 | ≥ 2.8.0a1, < 2.8.11 | ≥ 2.9.0a1, < 2.9.7 | ≥ 2.9.0, < 2.9.6
Red hat1 product
- ansibleall Ansible 2.7.x versions prior to 2.7.17 | all Ansible 2.8.x versions prior to 2.8.9 | all Ansible 2.9.x versions prior to 2.9.6
Ubuntu1 product
- ansibleAll versions (No fix recorded)
6 vendors · 9 products
References
24 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
Show all 24 references
- github.com/ansible/ansiblePACKAGE