VDB
GSD-2020-10684
GSD-2020-10684
PUBLISHED
CVSS 7.900000095367432 HIGH
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
Risk Scores
CVSS v3.1
7.900000095367432
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Ansible | all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.9.x versions prior to 2.9.6, * |
Timeline
- Feb 18, 2020 CVE Published
- Apr 16, 2026 Distribution Patch
- Apr 16, 2026 Security Advisory
- Apr 16, 2026 Security Advisory
References
- FEDORA-2020-1b6ce91e37 vendor-advisory
- FEDORA-2020-3990f03ba3 vendor-advisory
- FEDORA-2020-f80154b5b4 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10684 url
- GLSA-202006-11 advisory
- DSA-4950 advisory