CVE-2020-1738: red hat ansible Argument Injection

Vulnerability summary

CVE-2020-1738 is a low (CVSS 3.9) Argument Injection vulnerability in red hat ansible. EPSS estimates a 0.40% chance of exploitation in the next 30 days, higher than 32.7% of scored vulnerabilities.

Timeline

1. 16-03-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

• CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.