CVE-2020-1734

Name of the Vulnerable Software and Affected Versions Ansible (affected versions not specified)

Description The issue is related to the pipe lookup plugin of Ansible, where arbitrary commands can be run when the plugin uses subprocess.Popen() with shell=True by overwriting Ansible facts. The variable is not escaped by the quote plugin, allowing an attacker to take advantage and run arbitrary commands by overwriting the Ansible facts. This could potentially allow a perpetrator to elevate their privileges and execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.