Is CVE-2020-10684 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 0%.

What products does CVE-2020-10684 affect?

Tracked products affected include Ansible. Check the version you run to see whether it is affected.

How do I fix CVE-2020-10684?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

CVE-2020-10684

Q: What is CVE-2020-10684?

CVE-2020-10684 is a high-severity software vulnerability (Code injection) with a CVSS score of 7.9. A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ans

HIGH severity · CVSS 7.9 · Code injection

7.9CVSS HIGH

Summary

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.

Impact & exploitability

Attack vectorLocal

Attack complexityLow

Privileges requiredLow

User interactionRequired

Confidentiality impactNone

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)0%

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H

Affected products we track (1)

Ansible

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10684Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/
https://security.gentoo.org/glsa/202006-11Advisory
https://www.debian.org/security/2021/dsa-4950Advisory