CVE-2020-10729: Insufficiently Random Values in Ansible

Sponsored Habilume Habit tracker with a companion that grows with you Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent. App Store Google Play

Background

Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It uses a declarative language to describe system configurations and relies on SSH for communication with remote systems. Ansible is widely used in the industry due to its simplicity and scalability. However, a vulnerability has been discovered in Ansible versions before 2.9.6 that involves the use of insufficiently random values.

Vulnerability Detail

The vulnerability arises from the generation of random passwords in Ansible. When two random password lookups of the same length occur, they generate the same value as the template caching action for the same file. This happens because Ansible does not re-evaluate the password generation, leading to the exposure of all passwords for the file. The impact of this vulnerability is significant as it exposes sensitive passwords, potentially compromising the security of the system.

pip install --upgrade "ansible==14.5.0"

pip install --upgrade "ansible==2.9.6"

Workaround

If upgrading to the latest version is not immediately feasible, a possible workaround is to manually regenerate the passwords using a secure random number generator. This can be achieved by modifying the affected Ansible playbook or script to include a step that generates a new random password for each affected file. Here is an example of how this can be done in Python:

import random
import string

length = 10
new_password = ''.join(random.choice(string.ascii_letters + string.digits) for _ in range(length))

# Use the new_password variable in the playbook

Note that this workaround is temporary and should be replaced with the official fix as soon as possible.

Conclusion

In conclusion, the vulnerability in Ansible involving insufficiently random values can lead to the exposure of sensitive passwords. It is crucial to upgrade to Ansible Engine version 2.9.6 or later to mitigate this vulnerability. If immediate upgrading is not possible, a temporary workaround can be implemented. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for ansible →

FAQ