CVE-2020-25635: Ansible Base aws_ssm Connection Plugin Data Exposure
Summary
CVE-2020-25635: A flaw was found in Ansible Base when using the aws_ssm connection plugin as garbage collector is not happening after playbook run is completed. Affects ansible versions 1.0 – 7.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It provides a simple and powerful way to automate complex tasks across a variety of systems. The aws_ssm connection plugin in Ansible Base is used to connect to Amazon Web Services (AWS) Systems Manager Parameter Store. This plugin allows Ansible to securely retrieve sensitive data such as passwords, API keys, and other secrets stored in the Parameter Store. However, a flaw in the plugin prevents the garbage collector from running after a playbook run is completed. As a result, files remain in the bucket, exposing sensitive data and compromising data confidentiality.
Vulnerability Detail
The vulnerability (CVE-2020-25635) in Ansible Base's aws_ssm connection plugin allows an attacker to access sensitive data stored in the AWS Systems Manager Parameter Store. After a playbook run is completed, the garbage collector fails to remove the files from the bucket, leaving them exposed. This can lead to unauthorized access to sensitive information, potentially compromising the confidentiality of the data. The vulnerability affects the data confidentiality directly and poses a significant risk to organizations using Ansible Base with the aws_ssm connection plugin.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can manually delete the files from the AWS Systems Manager Parameter Store bucket after each playbook run. This can be done using the AWS Management Console, AWS CLI, or any other suitable method for managing S3 buckets. It is important to ensure that all sensitive data is properly removed to prevent unauthorized access.
Conclusion
The vulnerability (CVE-2020-25635) in Ansible Base's aws_ssm connection plugin exposes sensitive data stored in the AWS Systems Manager Parameter Store. It is crucial for organizations using Ansible Base with the aws_ssm connection plugin to upgrade to a patched version and follow the provided instructions to fix the vulnerability. Regular monitoring and cleanup of the Parameter Store bucket are also recommended to ensure data confidentiality. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible Base is an open-source automation tool used for configuration management, application deployment, and orchestration.
The aws_ssm connection plugin in Ansible Base allows users to securely retrieve sensitive data stored in the AWS Systems Manager Parameter Store.
This vulnerability exposes sensitive data stored in the AWS Systems Manager Parameter Store, compromising data confidentiality.
To fix this vulnerability, upgrade to a patched version of Ansible Base and follow the provided instructions in the security advisory.
Yes, users can manually delete the files from the AWS Systems Manager Parameter Store bucket after each playbook run.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
