Strix
26.1K

CVE-2020-1753

MEDIUMCVSS 5.5/10EPSS 0.51%

Last modified

CVE-2020-1753 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. EPSS estimates a 0.51% chance of exploitation in the next 30 days.

Description

A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.

Metrics

CVSS 3.1
5.5/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Probability
0.51%

39.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
RedhatAnsible Engine< 2.7.18
RedhatAnsible Engine>= 2.8.0, < 2.8.11
RedhatAnsible Engine>= 2.9.0, < 2.9.7
RedhatAnsible Tower<= 3.3.4
RedhatAnsible Tower>= 3.4.0, <= 3.4.5
RedhatAnsible Tower>= 3.5.0, <= 3.5.5
RedhatAnsible Tower>= 3.6.0, <= 3.6.3
DebianDebian Linux10.0
FedoraprojectFedora30
FedoraprojectFedora31
FedoraprojectFedora32

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-1753?
A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line, not using an environment variable or an input configuration file. This will disclose passwords and tokens from process list and no_log directive from debug module would not have any effect making these secrets being disclosed on stdout and log files.
How severe is CVE-2020-1753?
CVE-2020-1753 has a CVSS score of 5.5/10 (MEDIUM severity). The EPSS model estimates a 0.51% probability of exploitation in the next 30 days.
How do I fix CVE-2020-1753?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-1753?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST