redhat ansible CVE-2020-1739 vulnerability in Red Hat and Other Products
Published on March 12, 2020

product logo product logo product logo product logo
A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2020-1739 can be exploited with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is an Information Disclosure Vulnerability?

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVE-2020-1739 has been classified to as an Information Disclosure vulnerability or weakness.


Products Associated with CVE-2020-1739

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2020-1739 are published in these products:

Red Hat Ansible
 
Red Hat Ansible Tower
 
Red Hat Cloudforms Management Engine
 
Red Hat Openstack
 
Debian Linux
 
Fedora Project Fedora
 
Canonical Ubuntu Linux
 

Affected Versions

Red Hat Ansible:

Exploit Probability

EPSS
0.04%
Percentile
12.36%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.