VULNERABILITY INTELLIGENCE

CVE-2020-14365

CVSS score7.1 HIGH

EPSS probability0.23%

CISA KEVNot currently listed

Published2020-09-23

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Description

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

Weakness classification

secalert@redhat.com: CWE-347
nvd@nist.gov: CWE-347

Primary references

secalert@redhat.com — Issue Tracking, Vendor Advisory
secalert@redhat.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory