CVE-2020-14365: Improper Verification of Cryptographic Signature in Ansible
Summary
CVE-2020-14365: Improper Verification of Cryptographic Signature in ansible. Affects ansible across 2 version ranges.
>= 2.8.0a1, < 2.8.15
>= 2.9.0a1, < 2.9.13
Fixed in 2.8.15 or 2.9.13, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Alpine:v3.10
The same CVE-2020-14365 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate tasks such as configuration management, application deployment, and orchestration. It is widely used in IT infrastructure management and provides a simple and powerful way to automate complex tasks. However, a vulnerability has been discovered in Ansible Engine versions 2.8.x and 2.9.x that affects the installation of packages using the dnf module. This vulnerability allows malicious packages to be installed on the system and execute arbitrary code via package installation scripts.
Vulnerability Detail
The vulnerability arises from the improper verification of cryptographic signatures during package installation using the dnf module in Ansible. Even when the 'disable_gpg_check' option is set to False (the default behavior), GPG signatures are ignored. This flaw enables the installation of malicious packages on the system, leading to potential integrity and system availability issues. The severity of this vulnerability is rated as HIGH.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.8.0a1, < 2.8.152.8.15pip install --upgrade "ansible==2.8.15" -
>= 2.9.0a1, < 2.9.132.9.13pip install --upgrade "ansible==2.9.13"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed versions of Ansible Engine to mitigate the risk of malicious package installation.
Conclusion
In conclusion, the vulnerability in Ansible Engine allows for the installation of malicious packages and execution of arbitrary code. It is crucial to upgrade to the fixed versions (2.8.15 or later for ansible-engine 2.8.x, and 2.9.13 or later for ansible-engine 2.9.x) to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible Engine is an open-source automation tool used for configuration management, application deployment, and orchestration.
This vulnerability allows malicious packages to be installed on the system and execute arbitrary code, posing a risk to system integrity and availability.
Ansible Engine versions 2.8.x and 2.9.x are affected by this vulnerability.
Yes, fixed versions of Ansible Engine are available. Upgrade to ansible-engine 2.8.15 or later for 2.8.x versions, and ansible-engine 2.9.13 or later for 2.9.x versions.
No, there are no known workarounds. Upgrading to the fixed versions is the recommended approach.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
