CVE-2020-10729: debian debian_linux Use of Insufficiently Random Values

Vulnerability summary

CVE-2020-10729 is a medium (CVSS 5.5) Use of Insufficiently Random Values vulnerability in debian debian_linux. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 27-05-2021
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.

• CWE-330Use of Insufficiently Random ValuesThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.