CVE-2020-1746 in Red Hat and Debian Products
Published on May 12, 2020

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.

Vendor Advisory NVD

Vulnerability Analysis

CVE-2020-1746 is exploitable with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:

LOCAL

Attack Complexity:

LOW

Privileges Required:

LOW

User Interaction:

REQUIRED

Scope:

UNCHANGED

Confidentiality Impact:

HIGH

Integrity Impact:

NONE

Availability Impact:

NONE

Weakness Type

What is an Information Disclosure Vulnerability?

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

CVE-2020-1746 has been classified to as an Information Disclosure vulnerability or weakness.

Products Associated with CVE-2020-1746

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2020-1746 are published in these products:

Red Hat Ansible Engine

Red Hat Ansible Tower

Debian Linux

Affected Versions

Red Hat ansible:

Version ansible-engine versions 2.7.x before 2.7.17 is affected.
Version ansible-engine versions 2.8.x before 2.8.11 is affected.
Version ansible-engine versions 2.9.x before 2.9.7 is affected.
Version Ansible Tower <= 3.4.5 is affected.
Version Ansible Tower <= 3.5.5 is affected.
Version Ansible Tower <= 3.6.3 is affected.

Exploit Probability

EPSS

0.06%

Percentile

18.94%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.