CVE-2020-1739

Name of the Vulnerable Software and Affected Versions Ansible versions 2.7.16 and prior Ansible versions 2.8.8 and prior Ansible versions 2.9.5 and prior

Description A flaw was found in Ansible when a password is set with the argument password of the svn module, it is used on the svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs. The vulnerability is related to information disclosure and could allow an attacker to access confidential data and compromise its integrity.

Recommendations For Ansible versions 2.7.16 and prior, consider disabling the password argument of the svn module until a patch is available. For Ansible versions 2.8.8 and prior, restrict access to the svn module to minimize the risk of exploitation. For Ansible versions 2.9.5 and prior, avoid using the password argument in the svn module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.