https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:13:46 +0000 https://cve.radiocsirt.org/vuln/bdu:2022-00283 bdu:2022-00283 https://cve.radiocsirt.org/vuln/bdu:2022-00283 https://cve.radiocsirt.org/vuln/brew-ansible-cve-2020-1735 <p><strong>Affected:</strong> Homebrew: ansible</p> <p>A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.</p> <p><strong>Affected:</strong> Homebrew: ansible</p> <p>A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.</p> https://cve.radiocsirt.org/vuln/brew-ansible-cve-2020-1735 https://cve.radiocsirt.org/vuln/cnvd-2020-10514 cnvd-2020-10514 https://cve.radiocsirt.org/vuln/cnvd-2020-10514 https://cve.radiocsirt.org/vuln/euvd-2026-35579 EUVD-2026-35579 https://cve.radiocsirt.org/vuln/euvd-2026-35579 https://cve.radiocsirt.org/vuln/fkie_cve-2020-1735 <p>A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.</p> <p>A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-1735 https://cve.radiocsirt.org/vuln/ghsa-gfr2-qpxh-qj9m <p><strong>Affected:</strong> PyPI: ansible</p> <p>A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.</p> <p><strong>Affected:</strong> PyPI: ansible</p> <p>A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.</p> https://cve.radiocsirt.org/vuln/ghsa-gfr2-qpxh-qj9m https://cve.radiocsirt.org/vuln/gsd-2020-1735 gsd-2020-1735 https://cve.radiocsirt.org/vuln/gsd-2020-1735 https://cve.radiocsirt.org/vuln/oesa-2021-1349 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP2: ansible</p> <p>Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. Security Fix(es): A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument &amp;quot;password&amp;quot; of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.(CVE-2020-1739) A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes &amp;quot;ansible-vault edit&amp;quot;, another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.(CVE-2020-1740) A flaw was found in Ansible Engine when the module package or service is used and the parameter &amp;apos;use&amp;apos; is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the…</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP2: ansible</p> <p>Ansible is a radically simple model-driven configuration management, multi-node deployment, and remote task execution system. Ansible works over SSH and does not require any software or daemons to be installed on remote nodes. Extension modules can be written in any language and are transferred to managed machines automatically. Security Fix(es): A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument &amp;quot;password&amp;quot; of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.(CVE-2020-1739) A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes &amp;quot;ansible-vault edit&amp;quot;, another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.(CVE-2020-1740) A flaw was found in Ansible Engine when the module package or service is used and the parameter &amp;apos;use&amp;apos; is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the…</p> https://cve.radiocsirt.org/vuln/oesa-2021-1349 https://cve.radiocsirt.org/vuln/opensuse-su-2022:0081-1 <p>Security update for ansible</p> <p>Security update for ansible</p> https://cve.radiocsirt.org/vuln/opensuse-su-2022:0081-1 https://cve.radiocsirt.org/vuln/pysec-2020-7 <p><strong>Affected:</strong> PyPI: ansible</p> <p>A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.</p> <p><strong>Affected:</strong> PyPI: ansible</p> <p>A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.</p> https://cve.radiocsirt.org/vuln/pysec-2020-7 https://cve.radiocsirt.org/vuln/rhba-2020:0547 <p>glibc: getaddrinfo should reject IP addresses with trailing characters ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries openssl: timing side channel attack in the DSA signature algorithm procps: Local privilege escalation in top LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp nss: Cache side-channel variant of the Bleichenbacher attack binutils: Stack Exhaustion in the demangling functions provided by libiberty binutils: NULL pointer dereference in work_stuff_copy_to_from in cplus-dem.c. curl: NTLM password overflow via integer overflow python: Missing salt initialization in _elementtree.c module systemd: line splitting via fgets() allows for state injection during daemon-reexec elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file elfutils: Double-free due to double decompression of sections in crafted ELF causes crash elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash curl: Heap-based buffer over-read in the curl tool warning formatting systemd: out-of-bounds read when parsing a crafted syslog message systemd: kills privileged process if unprivileged PIDFile was tampered elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl elfutils: eu-size cannot handle recursive ar files elfutils: Divide-by-zero in arlib_add_symbols functio…</p> <p>glibc: getaddrinfo should reject IP addresses with trailing characters ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries openssl: timing side channel attack in the DSA signature algorithm procps: Local privilege escalation in top LibRaw: DoS in parse_rollei function in internal/dcraw_common.cpp LibRaw: DoS in parse_sinar_ia function in internal/dcraw_common.cpp nss: Cache side-channel variant of the Bleichenbacher attack binutils: Stack Exhaustion in the demangling functions provided by libiberty binutils: NULL pointer dereference in work_stuff_copy_to_from in cplus-dem.c. curl: NTLM password overflow via integer overflow python: Missing salt initialization in _elementtree.c module systemd: line splitting via fgets() allows for state injection during daemon-reexec elfutils: Heap-based buffer over-read in libdw/dwarf_getaranges.c:dwarf_getaranges() via crafted file elfutils: Double-free due to double decompression of sections in crafted ELF causes crash elfutils: Heap-based buffer over-read in libdw/dwarf_getabbrev.c and libwd/dwarf_hasattr.c causes crash curl: Heap-based buffer over-read in the curl tool warning formatting systemd: out-of-bounds read when parsing a crafted syslog message systemd: kills privileged process if unprivileged PIDFile was tampered elfutils: invalid memory address dereference was discovered in dwfl_segment_report_module.c in libdwfl elfutils: eu-size cannot handle recursive ar files elfutils: Divide-by-zero in arlib_add_symbols functio…</p> https://cve.radiocsirt.org/vuln/rhba-2020:0547 https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-1735 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: ansible, Ubuntu:Pro:16.04:LTS: ansible, Ubuntu:Pro:18.04:LTS: ansible, Ubuntu:Pro:20.04:LTS: ansible</p> <p>A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: ansible, Ubuntu:Pro:16.04:LTS: ansible, Ubuntu:Pro:18.04:LTS: ansible, Ubuntu:Pro:20.04:LTS: ansible</p> <p>A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2020-1735 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2478 <p>Ein lokaler Angreifer kann mehrere Schwachstellen in Ansible ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen in Ansible ausnutzen, um Sicherheitsvorkehrungen zu umgehen und Informationen offenzulegen</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2478