Race condition in Red Hat Ansible
Priority LOW 34CWE-362Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Security bypass, Code execution, Privilege escalation
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Partial Red Hat: 9 fixed, 5 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-862, CWE-94 and CWE-250.
Summary
A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.
Why it matters now
EPSS 0.00331 26th percentileScored 2026-11-07
Fix Partial ansible (PyPI): 2.7.17, 2.8.11, 2.9.7Red Hat: 4 advisoriesRed Hat: 9 fixed, 5 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Red Hat | Ansible | all Ansible 2.7.x versions prior to 2.7.17; all Ansible 2.8.x versions prior to 2.8.9; all Ansible 2.9.x versions prior to 2.9.6 | — | No fix listed | CNA |
| — | ansible (PyPI) | 2.7.0a1 to before 2.7.17 | 2.7.17 | Patch available | GHSA-p62g-jhg6-v3rq |
| — | ansible (PyPI) | 2.8.0a1 to before 2.8.11 | 2.8.11 | Patch available | GHSA-p62g-jhg6-v3rq |
| — | ansible (PyPI) | 2.9.0a1 to before 2.9.7 | 2.9.7 | Patch available | GHSA-p62g-jhg6-v3rq |
- Ansible VendorRed Hat Affected all Ansible 2.7.x versions prior to 2.7.17; all Ansible 2.8.x versions prior to 2.8.9; all Ansible 2.9.x versions prior to 2.9.6 Fixed in — No fix listed CNA
- ansible (PyPI) Vendor— Affected 2.7.0a1 to before 2.7.17 Fixed in 2.7.17 Patch available GHSA-p62g-jhg6-v3rq
- ansible (PyPI) Vendor— Affected 2.8.0a1 to before 2.8.11 Fixed in 2.8.11 Patch available GHSA-p62g-jhg6-v3rq
- ansible (PyPI) Vendor— Affected 2.9.0a1 to before 2.9.7 Fixed in 2.9.7 Patch available GHSA-p62g-jhg6-v3rq
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* | 2.7.0 to before 2.7.17; 2.8.0 to before 2.8.9; 2.9.0 to before 2.9.6 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:* | up to 3.3.5; 3.5.0 – 3.5.5; 3.6.0 – 3.6.3 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* | 10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* | 13 | Vulnerable | Red Hat |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
- cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* Versions 2.7.0 to before 2.7.17; 2.8.0 to before 2.8.9; 2.9.0 to before 2.9.6 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:* Versions up to 3.3.5; 3.5.0 – 3.5.5; 3.6.0 – 3.6.3 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
Remediation
- Fix · GHSA-p62g-jhg6-v3rq ansible (PyPI) Fixed in 2.7.17 Advisory →
- Fix · GHSA-p62g-jhg6-v3rq ansible (PyPI) Fixed in 2.8.11 Advisory →
- Fix · GHSA-p62g-jhg6-v3rq ansible (PyPI) Fixed in 2.9.7 Advisory →
Red Hat 4 advisories
- RHSA-2020:1543 Released 2020-04-22 · Red Hat rating ImportantAnsible security and bug fix update (2.8.11)
- Red Hat Ansible Engine 2.8 for RHEL 7 Server ansible-2.8.11-1.el7ae
- Red Hat Ansible Engine 2.8 for RHEL 8 ansible-2.8.11-1.el8ae
- RHSA-2020:1544 Released 2020-04-22 · Red Hat rating ImportantAnsible security and bug fix update (2.7.17)
- Red Hat Ansible Engine 2.7 for RHEL 7 Server ansible-2.7.17-1.el7ae
- RHSA-2020:1542 Released 2020-04-22 · Red Hat rating ImportantAnsible security and bug fix update (2.9.7)
- Red Hat Ansible Engine 2 for RHEL 7 ansible-2.9.7-1.el7ae, ansible-test-2.9.7-1.el7ae
- Red Hat Ansible Engine 2 for RHEL 8 ansible-2.9.7-1.el8ae, ansible-test-2.9.7-1.el8ae
Show 1 more Red Hat advisories
- RHSA-2020:1541 Released 2020-04-22 · Red Hat rating ImportantAnsible security and bug fix update (2.9.7)
- Red Hat Ansible Engine 2.9 for RHEL 7 Server ansible-2.9.7-1.el7ae, ansible-test-2.9.7-1.el7ae
- Red Hat Ansible Engine 2.9 for RHEL 8 ansible-2.9.7-1.el8ae, ansible-test-2.9.7-1.el8ae
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Engine 2 for RHEL 7 | Fixed | RHSA-2020:1542 |
| Red Hat Ansible Engine 2 for RHEL 8 | Fixed | RHSA-2020:1542 |
| Red Hat Ansible Engine 2.7 for RHEL 7 Server | Fixed | RHSA-2020:1544 |
| Red Hat Ansible Engine 2.8 for RHEL 7 Server | Fixed | RHSA-2020:1543 |
| Red Hat Ansible Engine 2.8 for RHEL 8 | Fixed | RHSA-2020:1543 |
| Red Hat Ansible Engine 2.9 for RHEL 7 Server | Fixed | RHSA-2020:1541 |
| Red Hat Ansible Engine 2.9 for RHEL 8 | Fixed | RHSA-2020:1541 |
| Red Hat Ansible Tower 3.4 for RHEL 7 Server | Fixed | — |
| Red Hat Ansible Tower 3.5 for RHEL 7 Server | Fixed | — |
Timeline
- 2026-10-02 Threatist record created from CVE-2020-10684
- 2026-10-03 Alias added: GHSA-p62g-jhg6-v3rq
References
Advisory 8
Other 9
- https://github.com/ansible/ansible/commit/0b4788a71fc7d24ffa957a94ee5e23d6a9733ab0
- https://github.com/ansible/ansible/commit/1d0d2645eed36ac4e17052ab4eacf240132d96fb
- https://github.com/ansible/ansible/commit/5eabf7bb93c9bfc375b806a2b1f623d650cddc2b
- https://github.com/ansible/ansible/commit/a9d2ceafe429171c0e2ad007058b88bae57c74ce
- https://github.com/ansible/ansible
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-207.yaml
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW
- https://lists.fedoraproject.org/archives/list/[email protected]/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S
- https://lists.fedoraproject.org/archives/list/[email protected]/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB
More Red Hat Ansible vulnerabilities
- TI-2016-07808 Improper input validation in Ansible CVSS 3.1HIGH 8.1
- TI-2014-03853 Injection in Ansible CVSS 3.1CRITICAL 9.8
- TI-2014-03839 The safe_eval function in Ansible before 1.5.4 does not properly restrict the code… CVSS 3.1CRITICAL 9.8
- TI-2017-05191 Sensitive information in log files in Red Hat ansible CVSS 3.1CRITICAL 9.8
- TI-2014-04077 Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote… CVSS 3.1CRITICAL 9.8
- TI-2014-04076 Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2020-10684 · CVE Program
- CVE-2020-10684 · NVD
- FIRST EPSS
- GHSA-p62g-jhg6-v3rq · GitHub Advisory Database · CC BY 4.0
- CVE-2020-10684 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences