The version of ansible installed on the remote host is prior to 2.9.9-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ANSIBLE2-2023-008 advisory.

    A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6     respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is     enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by     altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into     privilege escalation or code injection. (CVE-2020-10684)

    A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before     2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and     3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3     or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating     Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot     and the decryp emains when the host is switched off. The system will be vulnerable when the system is not     running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted     ble. (CVE-2020-10685)

    An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running     ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created     without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.
    (CVE-2020-10691)

    A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when     running a playbook with an unprivileged become user. When Ansible needs to run a module with become user,     the temporary directory is created in /var/tmp. This directory is created with umask 77 && mkdir -p     <dir>; this operation does not fail if the directory already exists and is owned by another user. An     attacker could take advantage to gain control of the become user as the target directory can be retrieved     by iterating '/proc/<pid>/cmdline'. (CVE-2020-1733)

    A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the     module, inject a new path, and then choose a new destination path on the controller node. All versions in     2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable. (CVE-2020-1735)

    A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user     executes ansible-vault edit, another user on the same computer can read the old and new secret, as it is     created in a temporary file with mkstemp and the returned file descriptor is closed and the method     write_data is called to write the existing secret in the file. This method will delete the file before     recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
    (CVE-2020-1740)

    A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x     before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and     3.5.5 and 3.6.3 when the ldap_attr and ldap_entry community modules are used. The issue discloses the LDAP     bind password to stdout or a log file if a playbook task is written using the bind_pw in the parameters     field. The highest threat from this vulnerability is data confidentiality. (CVE-2020-1746)

    A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x     versions prior to 2.8.11 and all Ansible 2.9.x versions prior to 2.9.7, when managing kubernetes using the     k8s module. Sensitive parameters such as passwords and tokens are passed to kubectl from the command line,     not using an environment variable or an input configuration file. This will disclose passwords and tokens     from process list and no_log directive from debug module would not have any effect making these secrets     being disclosed on stdout and log files. (CVE-2020-1753)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux 2 : ansible (ALASANSIBLE2-2023-008)

high Nessus Plugin ID 181996

Version 1.2

Version 1.1

Version 1.0

Version 1.2 Dec 12, 2024, 9:55 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202412120955
Version 1.1 Sep 28, 2023, 4:12 PM Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202309281612
Version 1.0 Sep 27, 2023, 10:33 PM New Plugin Feed: 202309272233