PyPI/ansible CVE-2020-1734: high 7.4, EPSS 0.46%
A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen() with shell=True, by overwriting ansible facts and the variable
Action: Upgrade ansible to 2.7.17 or later.
pip install ansible==2.7.17Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.7.17 | - |
Fixed versions
| 2.7.17 |
Sources
- osv: PYSEC-2020-6
- nvd: CVE-2020-1734
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1734
- https://github.com/ansible/ansible/issues/67792
- https://github.com/advisories/GHSA-h39q-95q5-9jfp
CVE-2020-1734 · published · modified · JSON