Critical Vulnerability in Ansible Packages: GPG Signature Bypass
Summary
ALPINE-CVE-2020-14365: A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. Affects ansible versions < 2.8.15-r0. Fixed in 2.8.15-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that simplifies the management of systems, applications, and networks. It allows users to automate tasks such as configuration management, application deployment, and orchestration. The affected versions of Ansible (2.8.x before 2.8.15 and 2.9.x before 2.9.13) have a critical vulnerability that compromises the integrity of package installations, potentially allowing malicious packages to be installed without proper verification.
Vulnerability Detail
A flaw was found in the Ansible Engine, specifically in the dnf module used for package installation. The vulnerability arises from the fact that GPG signatures are ignored during installation, even when the disable_gpg_check option is set to False, which is the default behavior. This oversight can lead to the installation of malicious packages, resulting in arbitrary code execution via package installation scripts. The severity of this vulnerability is underscored by its CVSS score of 7.1, indicating a high threat to system integrity and availability.
How To Fix
Minimum fixed version
2.8.15-r0
This is the first release that contains the fix.
sudo apk add --upgrade ansibleTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the use of the dnf module for package installations until the Ansible package is updated. This can be done by modifying your playbooks to use alternative methods for package management that do not rely on dnf.
Conclusion
The identified vulnerability in Ansible poses a significant risk to system integrity due to the bypassing of GPG signature checks during package installations. It is crucial for users to update to the patched versions of Ansible to mitigate this risk and ensure the security of their systems.
See every vulnerability recorded for ansible →
FAQ
The vulnerability allows malicious packages to be installed on the system, which can lead to arbitrary code execution and compromise system integrity.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Ansible versions 2.8.x before 2.8.15 and 2.9.x before 2.9.13 are affected by this vulnerability.
The CVSS score of this vulnerability is 7.1, indicating a high level of severity.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
