CVE Vulnerabilities

CVE-2020-10729

Use of Insufficiently Random Values

Published: May 27, 2021 | Modified: Dec 10, 2021
CVSS 3.x
5.5
MEDIUM
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
2.1 LOW
AV:L/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
5 MODERATE
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Ubuntu
MEDIUM

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.

Weakness

The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.

Affected Software

Name Vendor Start Version End Version
Ansible_engine Redhat * 2.9.6 (excluding)
Red Hat Ansible Engine 2.9 for RHEL 7 RedHat ansible-0:2.9.6-1.el7ae *
Red Hat Ansible Engine 2.9 for RHEL 8 RedHat ansible-0:2.9.6-1.el8ae *
Red Hat Ansible Tower 3.6 for RHEL 7 RedHat ansible-tower-36/ansible-tower:3.6.4-1 *
Ansible Ubuntu bionic *
Ansible Ubuntu eoan *
Ansible Ubuntu trusty *
Ansible Ubuntu upstream *
Ansible Ubuntu xenial *

Potential Mitigations

  • Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds.
  • In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts.
  • Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a “random enough” number.

References