A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue affects directly data confidentiality.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not
    happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue
    affects directly data confidentiality. (CVE-2020-25635)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not     happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue     affects directly data confidentiality. (CVE-2020-25635)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e1b77733-a982-442e-8796-a200571bfcf2 advisory.

  - A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not     happening after playbook run is completed. Files would remain in the bucket exposing the data. This issue     affects directly data confidentiality. (CVE-2020-25635)

  - A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace     separation for file transfers. Files are written directly to the root bucket, making possible to have     collisions when running multiple ansible processes. This issue affects mainly the service availability.
    (CVE-2020-25636)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
435902	SCA: security update for ansible (GHSA-f556-49jc-4rvc)	Tenable Cloud Security	SCA Checks	medium
435902	SCA: security update for ansible (GHSA-f556-49jc-4rvc)	Tenable Self-Hosted Container Security	SCA Checks	medium
250260	Linux Distros Unpatched Vulnerability : CVE-2020-25635	Nessus	Misc.	medium
174317	FreeBSD : py-ansible -- multiple vulnerabilities (e1b77733-a982-442e-8796-a200571bfcf2)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2020-25635

medium

Tenable Plugins

medium

medium

medium

high