CVE-2020-1735

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2020-03-16 · updated 2026-06-17
Weakness: CWE-22

Description

A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Affected products

Debian Linux: 10.0
Fedoraproject Fedora: 30, 31, 32
Red Hat Ansible: before 2.7.17; from 2.8.0 before 2.8.11; from 2.9.0 before 2.9.7 — fixed in 2.7.17, 2.8.11, 2.9.7
Tower: through 3.3.4; from 3.3.5 through 3.4.5; from 3.5.0 through 3.5.5; from 3.6.0 through 3.6.3
Red Hat CloudForms: 5.0
OpenStack: 13

How to fix

Upgrade to a fixed version: Red Hat Ansible 2.7.17, 2.8.11, 2.9.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-1735 or the next vulnerability affects your stack