CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2020-14365

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.001

EPSS Ranking 22.0%

CVSS Severity

CVSS v3 Score 7.1

CVSS v2 Score 6.6

References

Products affected by CVE-2020-14365

Redhat » Ansible Engine » Version: 2.8.0

cpe:2.3:a:redhat:ansible_engine:2.8.0
Redhat » Ansible Engine » Version: 2.8.1

cpe:2.3:a:redhat:ansible_engine:2.8.1
Redhat » Ansible Engine » Version: 2.8.11

cpe:2.3:a:redhat:ansible_engine:2.8.11
Redhat » Ansible Engine » Version: 2.8.14

cpe:2.3:a:redhat:ansible_engine:2.8.14
Redhat » Ansible Engine » Version: 2.8.15

cpe:2.3:a:redhat:ansible_engine:2.8.15
Redhat » Ansible Engine » Version: 2.8.2

cpe:2.3:a:redhat:ansible_engine:2.8.2
Redhat » Ansible Engine » Version: 2.8.3

cpe:2.3:a:redhat:ansible_engine:2.8.3
Redhat » Ansible Engine » Version: 2.8.4

cpe:2.3:a:redhat:ansible_engine:2.8.4
Redhat » Ansible Engine » Version: 2.8.5

cpe:2.3:a:redhat:ansible_engine:2.8.5
Redhat » Ansible Engine » Version: 2.8.6

cpe:2.3:a:redhat:ansible_engine:2.8.6
Redhat » Ansible Engine » Version: 2.8.8

cpe:2.3:a:redhat:ansible_engine:2.8.8
Redhat » Ansible Engine » Version: 2.8.9

cpe:2.3:a:redhat:ansible_engine:2.8.9
Redhat » Ansible Engine » Version: 2.9.0

cpe:2.3:a:redhat:ansible_engine:2.9.0
Redhat » Ansible Engine » Version: 2.9.12

cpe:2.3:a:redhat:ansible_engine:2.9.12
Redhat » Ansible Engine » Version: 2.9.13

cpe:2.3:a:redhat:ansible_engine:2.9.13
Redhat » Ansible Engine » Version: 2.9.3

cpe:2.3:a:redhat:ansible_engine:2.9.3
Redhat » Ansible Engine » Version: 2.9.5

cpe:2.3:a:redhat:ansible_engine:2.9.5
Redhat » Ansible Engine » Version: 2.9.6

cpe:2.3:a:redhat:ansible_engine:2.9.6
Redhat » Ansible Engine » Version: 2.9.7

cpe:2.3:a:redhat:ansible_engine:2.9.7
Redhat » Ansible Tower » Version: 3.0

cpe:2.3:a:redhat:ansible_tower:3.0
Redhat » Ansible Tower » Version: 3.6.0

cpe:2.3:a:redhat:ansible_tower:3.6.0
Redhat » Ansible Tower » Version: 3.6.1

cpe:2.3:a:redhat:ansible_tower:3.6.1
Redhat » Ansible Tower » Version: 3.6.2

cpe:2.3:a:redhat:ansible_tower:3.6.2
Redhat » Ansible Tower » Version: 3.6.3

cpe:2.3:a:redhat:ansible_tower:3.6.3
Redhat » Ansible Tower » Version: 3.6.4

cpe:2.3:a:redhat:ansible_tower:3.6.4
Redhat » Ansible Tower » Version: 3.6.5

cpe:2.3:a:redhat:ansible_tower:3.6.5
Redhat » Ansible Tower » Version: 3.7.0

cpe:2.3:a:redhat:ansible_tower:3.7.0
Redhat » Ansible Tower » Version: 3.7.1

cpe:2.3:a:redhat:ansible_tower:3.7.1
Redhat » Ansible Tower » Version: 3.7.2

cpe:2.3:a:redhat:ansible_tower:3.7.2
Redhat » Ceph Storage » Version: 2.0

cpe:2.3:a:redhat:ceph_storage:2.0
Redhat » Ceph Storage » Version: 3.0

cpe:2.3:a:redhat:ceph_storage:3.0
Redhat » Openstack Platform » Version: 10.0

cpe:2.3:a:redhat:openstack_platform:10.0
Redhat » Openstack Platform » Version: 13.0

cpe:2.3:a:redhat:openstack_platform:13.0
Debian » Debian Linux » Version: 10.0

cpe:2.3:o:debian:debian_linux:10.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2020-14365

Products

Pricing

Contact Us