CVE-2020-14365
2 advisories.
PyPI/ansible CVE-2020-14365: high 7.1, EPSS 0.23%
Improper Verification of Cryptographic Signature in ansible
Action: Upgrade ansible to 2.8.15 or later.
pip install ansible==2.8.15pip install ansible==2.9.13Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.8.0a1 | 2.8.15 | - |
| 2.9.0a1 | 2.9.13 | - |
Fixed versions
| 2.8.15 | 2.9.13 |
Sources
- osv: GHSA-m429-fhmv-c6q2
- https://nvd.nist.gov/vuln/detail/CVE-2020-14365
- https://github.com/ansible/ansible/commit/1d043e082b3b1f3ad35c803137f5d3bcbae92275
- https://github.com/ansible/ansible/commit/1fa2d5fd6b768120b76a77929e27302b06accc0c
- https://github.com/ansible/ansible/commit/9bea33ffa3be3d64827f59882d95b817cfab9b7e
- https://bugzilla.redhat.com/show_bug.cgi?id=1869154
- https://github.com/advisories/GHSA-m429-fhmv-c6q2
- https://github.com/ansible/ansible
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-209.yaml
- https://www.debian.org/security/2021/dsa-4950
CVE-2020-14365 · published · modified · JSON
PyPI/ansible CVE-2020-14365: unknown, EPSS 0.23%
A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during i
Action: Upgrade ansible to 2.8.16rc1 or later.
pip install ansible==2.8.16rc1pip install ansible==2.9.14rc1Affected
| introduced | fixed | last affected |
|---|---|---|
| 2.8.0 | 2.8.16rc1 | - |
| 2.9.0 | 2.9.14rc1 | - |
Fixed versions
| 2.8.16rc1 | 2.9.14rc1 |
Sources
- osv: PYSEC-2020-209
- https://bugzilla.redhat.com/show_bug.cgi?id=1869154
- https://github.com/advisories/GHSA-m429-fhmv-c6q2
CVE-2020-14365 · published · modified · JSON