Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2020-1734
7.4
HIGHCVSS v3
Published
March 3, 2020
CVSS v2
3.7 LOW
Affected
2 projects
Assigned by
Red Hat
Severity scale
010
Description
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.
ansible/ansible
GitHubAnsible is a radically simple IT automation platform that makes your applications and systems easier to deploy and maintain. Automate everything from code deployment to network configuration to cloud management, in a language that approaches plain English, using SSH, with no agents to install on remote systems. https://docs.ansible.com.
GitHubAnsible is a radically simple IT automation platform that makes your applications and systems easier to deploy and maintain. Automate everything from code deployment to network configuration to cloud management, in a language that approaches plain English, using SSH, with no agents to install on remote systems. https://docs.ansible.com.>= 2.10.0a1, < 2.10.0rc1, >= 2.9.0a1, < 2.9.11, < 2.8.13, < 2.7.17NVD
ansiblePython Package IndexRadically simple IT automation
Python Package IndexRadically simple IT automation>= 2.10.0a1, < 2.10.0rc1, >= 2.9.0a1, < 2.9.11, < 2.8.13, < 2.7.17OSV