5.5
CVE-2020-1753
- EPSS 0.04%
- Veröffentlicht 16.03.2020 15:15:13
- Zuletzt bearbeitet 21.11.2024 05:11:18
- Quelle secalert@redhat.com
- Teams Watchlist Login
- Unerledigt Login
A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Redhat ≫ Ansible Engine Version < 2.7.18
Redhat ≫ Ansible Engine Version >= 2.8.0 < 2.8.11
Redhat ≫ Ansible Engine Version >= 2.9.0 < 2.9.7
Redhat ≫ Ansible Tower Version <= 3.3.4
Redhat ≫ Ansible Tower Version >= 3.4.0 <= 3.4.5
Redhat ≫ Ansible Tower Version >= 3.5.0 <= 3.5.5
Redhat ≫ Ansible Tower Version >= 3.6.0 <= 3.6.3
Debian ≫ Debian Linux Version10.0
Fedoraproject ≫ Fedora Version30
Fedoraproject ≫ Fedora Version31
Fedoraproject ≫ Fedora Version32
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.04% | 0.103 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
|
| nvd@nist.gov | 2.1 | 3.9 | 2.9 |
AV:L/AC:L/Au:N/C:P/I:N/A:N
|
| secalert@redhat.com | 5 | 1.3 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-214 Invocation of Process Using Visible Sensitive Information
A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be seen by other processes on the operating system.
CWE-532 Insertion of Sensitive Information into Log File
The product writes sensitive information to a log file.