« Volver al listado

CVE-2020-14365

Estado: ModificadaAlta (7.1)—

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

Debian — Debian LinuxRedhat — Ansible EngineRedhat — Ansible TowerRedhat — Ceph StorageRedhat — Openstack Platform

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-14365",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 9.2,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.1,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "ansible",
          "versions": [
            {
              "status": "affected",
              "version": "ansible-engine 2.8.15, ansible-engine 2.9.13"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-09-23T13:15:15.470",
  "references": [
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://www.debian.org/security/2021/dsa-4950",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869154",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.debian.org/security/2021/dsa-4950",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability."
    },
    {
      "lang": "es",
      "value": "Se encontró un fallo en Ansible Engine, en ansible-engine versiones 2.8.x anteriores a 2.8.15 y ansible-engine versiones 2.9.x anteriores a 2.9.13, Cuando se instalan paquetes usando el módulo dnf. Unas firmas GPG son ignoradas durante la instalación incluso cuando disable_gpg_check es establecida en False, que es el comportamiento predeterminado. Este fallo  conlleva a que son instalados paquetes maliciosos en el sistema y son ejecutados códigos arbitrarios por medio de scripts de instalación de paquetes. La mayor amenaza de esta vulnerabilidad es la integridad y la disponibilidad del sistema"
    }
  ],
  "lastModified": "2026-06-17T02:54:37.907",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "128A8518-1B23-4263-8958-2A3813E70EAD",
              "versionEndIncluding": "2.8.15",
              "versionStartIncluding": "2.8.0"
            },
            {
              "criteria": "cpe:2.3:a:redhat:ansible_engine:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2633DB82-E043-4132-9493-B4CBB25FAE82",
              "versionEndIncluding": "2.9.13",
              "versionStartIncluding": "2.9.0"
            },
            {
              "criteria": "cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8EA99A5E-25E4-42A8-92D3-017734DA0AA7",
              "versionEndIncluding": "3.6.5",
              "versionStartIncluding": "3.6.0"
            },
            {
              "criteria": "cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "DDE01259-A945-4567-AB95-8DAB087A686A",
              "versionEndIncluding": "3.7.2",
              "versionStartIncluding": "3.7.0"
            },
            {
              "criteria": "cpe:2.3:a:redhat:ansible_tower:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B31C575C-06D2-4CAF-A5B7-B9469B3ED55F"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:ceph_storage:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D07DF15E-FE6B-4DAF-99BB-2147CF7D7EEA"
            },
            {
              "criteria": "cpe:2.3:a:redhat:ceph_storage:3.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "516F4E8E-ED2F-4282-9DAB-D8B378F61258"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openstack_platform:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "542B31BD-5767-4B33-9201-40548D1223B3"
            },
            {
              "criteria": "cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C52600BF-9E87-4CD2-91F3-685AFE478C1E"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}