PyPI/ansible CVE-2020-1739: unknown, EPSS 0.36%
A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with the argument "password" of svn module, it is used on svn command line, disclosing to othe
Action: Upgrade ansible to 2.7.17 or later.
pip install ansible==2.7.17pip install ansible==2.8.9pip install ansible==2.9.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.17 | - |
| 2.8.0 | 2.8.9 | - |
| 2.9.0 | 2.9.6 | - |
Fixed versions
| 2.7.17 | 2.8.9 | 2.9.6 |
Sources
- osv: PYSEC-2020-11
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739
- https://github.com/ansible/ansible/issues/67797
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/
- https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html
- https://github.com/advisories/GHSA-923p-fr2c-g5m2
CVE-2020-1739 · published · modified · JSON