CVE-2020-1753: A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux10.0
• fedoraproject fedora30
• fedoraproject fedora31
• fedoraproject fedora32
• redhat ansible enginebefore 2.7.18
• redhat ansible engine2.8.0 and later · before 2.8.11
• redhat ansible engine2.9.0 and later · before 2.9.7
• redhat ansible tower3.6.0 and later · up to 3.6.3 inclusive
• redhat ansible tower3.5.0 and later · up to 3.5.5 inclusive
• redhat ansible tower3.4.0 and later · up to 3.4.5 inclusive
• redhat ansible towerup to 3.3.4 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• Red Hat Ansible

  • all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11, all Ansible 2.9.x versions prior to 2.9.7affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2021-20228A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protected by the no_log feature when
  31Monitor
• CVE-2020-1737A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip mo
  31Monitor
• CVE-2019-14846In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine 2.6.19, were logging at the DEBUG
  31Monitor

Published before and after this one in the same product

• ← EarlierCVE-2019-14858Oct 14, 2019 · A vulnerability was found in Ansible engine 2.x up to 2.8 and Ansible tower 3.x up to 3.5.
  22Monitor
• ← EarlierCVE-2020-1734Mar 3, 2020 · A flaw was found in the pipe lookup plugin of ansible.
  29Monitor
• Later →CVE-2019-14905Mar 31, 2020 · A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in Ansib
  22Monitor

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.