---
cve: "CVE-2020-10684"
severity: "HIGH"
cvss: 7.9
epss: "35%"
vendor: "Red Hat"
kev: false
exploited: false
published: "2020-03-24 14:15:12"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-08T09:13:53+02:00"
---

# CVE-2020-10684

> 7.9 HIGH

## Beschreibung

A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Erforderlich | good |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Keine | good |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- f78a5b184c6f8b1bc774ed795a2bd36d38f6506b (Commit)
- 668cdc3ce88d9d69093a81271b34c69897ef2b57 (Commit)

## Referenzen

- <https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/>
- <https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/>
- <https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/>
- <https://security.gentoo.org/glsa/202006-11>
- <https://www.debian.org/security/2021/dsa-4950>
- <https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10684>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2020-10684) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_