A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x     before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during     installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads     to malicious packages being installed on the system and arbitrary code executed via package installation     scripts. The highest threat from this vulnerability is to integrity and system availability.
    (CVE-2020-14365)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x
    before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during
    installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads
    to malicious packages being installed on the system and arbitrary code executed via package installation
    scripts. The highest threat from this vulnerability is to integrity and system availability.
    (CVE-2020-14365)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1509-1 advisory.

    POS_Image-Graphical7 was updated to version 0.1.1710765237.46af599:

    - Version 0.1.1710765237.46af599

      * Moved image services to dracut-saltboot package
      * Use salt bundle

    - Version 0.1.1645440615.7f1328c

      * Removed deprecated kiwi functions

    POS_Image-JeOS7 was updated to version 0.1.1710765237.46af599:

    - Version 0.1.1710765237.46af599

      * Moved image services to dracut-saltboot package
      * Use salt bundle

    - Version 0.1.1645440615.7f1328c

      * Removed deprecated kiwi functions

    ansible received the following fixes:

    - Security issues fixed:

      * CVE-2023-5764: Address issues where internal templating can cause unsafe         variables to lose their unsafe designation (bsc#1216854)

        - Breaking changes:
          assert - Nested templating may result in an inability for the conditional           to be evaluated. See the porting guide for more information.

      * CVE-2024-0690: Address issue where ANSIBLE_NO_LOG was ignored (bsc#1219002)
      * CVE-2020-14365: Ensure that packages are GPG validated (bsc#1175993)
      * CVE-2020-10744: Fixed insecure temporary directory creation (bsc#1171823)
      * CVE-2018-10874: Fixed inventory variables loading from current working directory when running ad-hoc     command that         can lead to code execution (bsc#1099805)

    - Bugs fixed:

      * Don't Require python-coverage, it is needed only for testing (bsc#1177948)

    dracut-saltboot was updated to version 0.1.1710765237.46af599:

    - Version 0.1.1710765237.46af599

      * Load only first available leaseinfo (bsc#1221092)

    - Version 0.1.1681904360.84ef141

    grafana was updated to version 9.5.18:

    - Grafana now requires Go 1.20
    - Security issues fixed:

      * CVE-2024-1313: Require same organisation when deleting snapshots (bsc#1222155)
      * CVE-2023-6152: Add email verification when updating user email (bsc#1219912)

    - Other non-security related changes:

      * Version 9.5.17:

        - [FEATURE] Alerting: Backport use Alertmanager API v2

      * Version 9.5.16:

        - [BUGFIX] Annotations: Split cleanup into separate queries and           deletes to avoid deadlocks on MySQL

      * Version 9.5.15:

        - [FEATURE] Alerting: Attempt to retry retryable errors

      * Version 9.5.14:

        - [BUGFIX] Alerting: Fix state manager to not keep           datasource_uid and ref_id labels in state after Error
        - [BUGFIX] Transformations: Config overrides being lost when           config from query transform is applied
        - [BUGFIX] LDAP: Fix enable users on successfull login

      * Version 9.5.13:

        - [BUGFIX] BrowseDashboards: Only remember the most recent           expanded folder
        - [BUGFIX] Licensing: Pass func to update env variables when           starting plugin

      * Version 9.5.12:

        - [FEATURE] Azure: Add support for Workload Identity           authentication

      * Version 9.5.9:

        - [FEATURE] SSE: Fix DSNode to not panic when response has empty           response
        - [FEATURE] Prometheus: Handle the response with different field           key order
        - [BUGFIX] LDAP: Fix user disabling

    mgr-daemon was updated to version 4.3.9-0:

    - Version 4.3.9-0

      * Update translation strings

    spacecmd was updated to version 4.3.27-0:

    - Version 4.3.27-0

      * Update translation strings

    spacewalk-client-tools was updated to version 4.3.19-0:

    - Version 4.3.19-0

      * Update translation strings

    spacewalk-koan was updated to version version 4.3.6-0:

    - Version 4.3.6-0

      * Change Docker image location for test

    uyuni-common-libs was updated to version 4.3.10-0:

    - Version 4.3.10-0

      * Add support for package signature type V4 RSA/SHA384
      * Add support for package signature type V4 RSA/SHA512 (bsc#1221465)

    uyuni-proxy-systemd-services was updated to version 4.3.12-0:

    - Version 4.3.12-0

      * Update to SUSE Manager 4.3.12

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where
    sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or
    outputs of performed tasks to read keys used in playbooks from other users within the uri module. The
    highest threat from this vulnerability is to data confidentiality. (CVE-2020-14330)

  - A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-
    mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized
    users to read this data. The highest threat from this vulnerability is to confidentiality.
    (CVE-2020-14332)

  - A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x
    before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during
    installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads
    to malicious packages being installed on the system and arbitrary code executed via package installation
    scripts. The highest threat from this vulnerability is to integrity and system availability.
    (CVE-2020-14365)

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - In Ansible, all Ansible Engine versions up to ansible-engine 2.8.5, ansible-engine 2.7.13, ansible-engine
    2.6.19, were logging at the DEBUG level which lead to a disclosure of credentials if a plugin used a
    library that logged credentials at the DEBUG level. This flaw does not affect Ansible modules, as those
    are executed in a separate process. (CVE-2019-14846)

  - An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where
    sensitive data is exposed to content and json output. This flaw allows an attacker to access the logs or
    outputs of performed tasks to read keys used in playbooks from other users within the uri module. The
    highest threat from this vulnerability is to data confidentiality. (CVE-2020-14330)

  - A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-
    mode) do not properly neutralize sensitive data exposed in the event data. This flaw allows unauthorized
    users to read this data. The highest threat from this vulnerability is to confidentiality.
    (CVE-2020-14332)

  - A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x
    before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during
    installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads
    to malicious packages being installed on the system and arbitrary code executed via package installation
    scripts. The highest threat from this vulnerability is to integrity and system availability.
    (CVE-2020-14365)

The version of ansible installed on the remote host is prior to 2.9.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2ANSIBLE2-2023-005 advisory.

    A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x     before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during     installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads     to malicious packages being installed on the system and arbitrary code executed via package installation     scripts. The highest threat from this vulnerability is to integrity and system availability.
    (CVE-2020-14365)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-4950 advisory.

    Several vulnerabilities have been found in Ansible, a configuration management, deployment and task     execution system, which could result in information disclosure or argument injection. In addition a race     condition in become_user was fixed. For the stable distribution (buster), these problems have been fixed     in version 2.7.7+dfsg-1+deb10u1. We recommend that you upgrade your ansible packages. For the detailed     security status of ansible please refer to its security tracker page at: https://security-     tracker.debian.org/tracker/ansible

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3602 advisory.

    Ansible is a simple model-driven configuration management, multi-node     deployment, and remote-task execution system. Ansible works over SSH and     does not require any software or daemons to be installed on remote nodes.
    Extension modules can be written in any language and are transferred to     managed machines automatically.

    The following packages have been upgraded to a newer upstream version:
    ansible (2.9.13)

    Bug Fix(es):
    * CVE-2020-14365 ansible: dnf module install packages with no GPG signature

    See:
    https://github.com/ansible/ansible/blob/v2.9.13/changelogs/CHANGELOG-v2.9.rst     for details on bug fixes in this release.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3601 advisory.

    Ansible is a simple model-driven configuration management, multi-node     deployment, and remote-task execution system. Ansible works over SSH and     does not require any software or daemons to be installed on remote nodes.
    Extension modules can be written in any language and are transferred to     managed machines automatically.

    The following packages have been upgraded to a newer upstream version:
    ansible (2.9.13)

    Bug Fix(es):
    * CVE-2020-14365 ansible: dnf module install packages with no GPG signature

    See:
    https://github.com/ansible/ansible/blob/v2.9.13/changelogs/CHANGELOG-v2.9.rst     for details on bug fixes in this release.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3600 advisory.

    Ansible is a simple model-driven configuration management, multi-node     deployment, and remote-task execution system. Ansible works over SSH and     does not require any software or daemons to be installed on remote nodes.
    Extension modules can be written in any language and are transferred to     managed machines automatically.

    The following packages have been upgraded to a newer upstream version:
    ansible (2.8.15)

    Bug Fix(es):
    * CVE-2020-14365 ansible: dnf module install packages with no GPG signature

    See:
    https://github.com/ansible/ansible/blob/v2.8.15/changelogs/CHANGELOG-v2.8.rst     for details on bug fixes in this release.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
246151	Linux Distros Unpatched Vulnerability : CVE-2020-14365	Nessus	Misc.	high
416702	SCA: security update for ansible (GHSA-m429-fhmv-c6q2)	Tenable Cloud Security	SCA Checks	medium
416702	SCA: security update for ansible (GHSA-m429-fhmv-c6q2)	Tenable Self-Hosted Container Security	SCA Checks	medium
195097	SUSE SLES15: POS_Image-Graphical7 / POS_Image-JeOS7 / ansible / ansible-doc / etc (SUSE-SU-2024:1509-1)	Nessus	SuSE Local Security Checks	critical
403525	Alpine: ansible-base: security update to 2.9.13-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403525	Alpine: ansible-base: security update to 2.9.13-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
403515	Alpine: multiple ansible packages: security update to 2.9.13-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403515	Alpine: multiple ansible packages: security update to 2.9.13-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
403507	Alpine: multiple ansible packages: security update to 2.8.15-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
403507	Alpine: multiple ansible packages: security update to 2.8.15-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
181973	Amazon Linux 2 : ansible (ALASANSIBLE2-2023-005)	Nessus	Amazon Linux Local Security Checks	high
152270	Debian DSA-4950-1 : ansible - security update	Nessus	Debian Local Security Checks	high
140130	RHEL 7 / 8 : Ansible security update (2.9.13) (Important) (RHSA-2020:3602)	Nessus	Red Hat Local Security Checks	high
140128	RHEL 7 / 8 : Ansible security update (2.9.13) (Important) (RHSA-2020:3601)	Nessus	Red Hat Local Security Checks	high
140127	RHEL 7 / 8 : Ansible security update (2.8.15) (Important) (RHSA-2020:3600)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2020-14365

medium

Tenable Plugins

high

medium

medium

critical

high

high

high

high

high

high

high

high

high

high

high