CVE-2020-1753

Ansible: kubectl connection plugin leaks sensitive information

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat

Products

Debian Linux Fedora Ansible Engine and 1 more

CVE-2020-1750

machine-config-operator-container: mmap stressor makes the cluster unresponsive

A flaw was found in the machine-config-operator that causes an OpenShift node to become unresponsive when a container consumes a large amount of memory. An attacker could use this flaw to deny access to schedule new pods in the OpenShift cluster. This was fixed in openshift/machine-config-operator 4.4.3, openshift/machine-config-operator 4.3.25, openshift/machine-config-operator 4.2.36.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Machine-config-operator Openshift

CVE-2020-1749

kernel: some ipv6 protocols not encrypted over ipsec tunnel

A flaw was found in the Linux kernel's implementation of some networking protocols in IPsec, such as VXLAN and GENEVE tunnels over IPv6. When an encrypted tunnel is created between two hosts, the kernel isn't correctly routing tunneled data over the encrypted link; rather sending the data unencrypted. This would allow anyone in between the two endpoints to read the traffic unencrypted. The main threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Mrg and 1 more

CVE-2020-1748

Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain

A flaw was found in all supported versions before wildfly-elytron-1.6.8.Final-redhat-00001, where the WildFlySecurityManager checks were bypassed when using custom security managers, resulting in an improper authorization. This flaw leads to information exposure by unauthenticated access to secure resources.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Redhat

Products

Decision Manager Jboss Data Grid Jboss Enterprise Application Platform and 6 more

CVE-2020-1747

PyYAML: arbitrary command execution through python/object/new when FullLoader is used

A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.

CVSS 3.1 · 9.8 Critical EPSS 5.4% KEV · Not listed

Vendors

Fedoraproject Opensuse Oracle and 2 more

Products

Fedora Leap Communications Cloud Native Core Network Function Cloud Native Environment and 2 more

CVE-2020-1746

ansible: Information disclosure issue in ldap_attr and ldap_entry modules

A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters field. The highest threat from this vulnerability is data confidentiality.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Redhat

Products

Debian Linux Ansible Engine Ansible Tower

CVE-2020-1745

undertow: AJP File Read/Inclusion Vulnerability

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.

CVSS 3.1 · 8.6 High EPSS 5.0% KEV · Not listed

Vendors

Redhat

Products

Jboss Data Grid Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd and 5 more

CVE-2020-1744

keycloak: failedLogin Event not sent to BruteForceProtector when using Post Login Flow with Conditional-OTP

A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.

CVSS 3.1 · 5.6 Medium EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Openshift Application Runtimes and 1 more

CVE-2020-1742

nmstate/kubernetes-nmstate-handler: /etc/passwd is given incorrect privileges

An insecure modification vulnerability flaw was found in containers using nmstate/kubernetes-nmstate-handler. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges. Versions before kubernetes-nmstate-handler-container-v2.3.0-30 are affected.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Nmstate Redhat

Products

Kubernetes-nmstate Container Native Virtualization Openshift Virtualization

CVE-2020-1741

openshift-ansible: cors allowed origin allows changing url protocol

A flaw was found in openshift-ansible. OpenShift Container Platform (OCP) 3.11 is too permissive in the way it specified CORS allowed origins during installation. An attacker, able to man-in-the-middle the connection between the user's browser and the openshift console, could use this flaw to perform a phishing attack. The main threat from this vulnerability is data confidentiality.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Openshift Container Platform

CVE-2020-1740

ansible: secrets readable after ansible-vault edit

A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat

Products

Debian Linux Fedora Ansible and 4 more

CVE-2020-1739

ansible: svn module leaks password when specified as a parameter

A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat

Products

Debian Linux Fedora Ansible and 4 more

CVE-2020-1738

ansible: module package can be selected by the ansible facts

A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Ansible Tower Cloudforms Management Engine and 1 more

CVE-2020-1737

ansible: Extract-Zip function in win_unzip module does not check extracted path

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Engine Ansible Tower

CVE-2020-1736

ansible: atomic_move primitive sets permissive permissions

A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

CVSS 3.1 · 2.2 Low EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Fedora Ansible Ansible Engine and 3 more

CVE-2020-1735

ansible: path injection on dest parameter in fetch module

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat

Products

Debian Linux Fedora Ansible and 4 more

CVE-2020-1734

ansible: shell enabled by default in a pipe lookup plugin subprocess

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by overwriting the ansible facts.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ansible Engine Ansible Tower

CVE-2020-1733

ansible: insecure temporary directory when running become_user from become directive

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat

Products

Debian Linux Fedora Ansible and 4 more

CVE-2020-1732

Soteria: security identity corruption across concurrent threads

A flaw was found in Soteria before 1.0.1, in a way that multiple requests occurring concurrently causing security identity corruption across concurrent threads when using EE Security with WildFly Elytron which can lead to the possibility of being handled using the identity from another request.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Jboss Enterprise Application Platform Cd Jboss Enterprise Application Platform Continuous Delivery and 2 more

CVE-2020-1731

keycloak: generates same admin password while installation when deployed on same openshift namespace

A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace.

CVSS 3.1 · 9.1 Critical EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Keycloak Operator