7.1

CVE-2020-14365

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Ansible Engine Version >= 2.8.0 <= 2.8.15
Redhat ≫ Ansible Engine Version >= 2.9.0 <= 2.9.13
Redhat ≫ Ansible Tower Version >= 3.6.0 <= 3.6.5
Redhat ≫ Ansible Tower Version >= 3.7.0 <= 3.7.2
Redhat ≫ Ansible Tower Version 3.0
Redhat ≫ Ceph Storage Version 2.0
Redhat ≫ Ceph Storage Version 3.0
Redhat ≫ Openstack Platform Version 10.0
Redhat ≫ Openstack Platform Version 13.0
Debian ≫ Debian Linux Version 10.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.23% 0.139
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.1 1.8 5.2
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
NIST 6.6 3.9 9.2
AV:L/AC:L/Au:N/C:N/I:C/A:C
CWE-347 Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

https://www.debian.org/security/2021/dsa-4950
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1869154
Vendor Advisory
Issue Tracking