CVE-2020-14365

HIGH Year: 2020
CVSS v3 Score
7.1
High
CVSS v2 Score
6.6
Medium
Weakness Type
CWE-347
View all →

Vulnerability Description

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

Related Vulnerabilities

CVE-2020-25166

HIGH
CVSS:7.1(High)

An improper verification of the cryptographic signature of firmware updates of the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allo...

CWE-3472020

CVE-2023-23431

HIGH
CVSS:7.1(High)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.

CWE-3472023

CVE-2023-23432

HIGH
CVSS:7.1(High)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.

CWE-3472023

CVE-2023-23433

HIGH
CVSS:7.1(High)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.

CWE-3472023

CVE-2023-23435

HIGH
CVSS:7.1(High)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file

CWE-3472023

CVE-2023-23436

HIGH
CVSS:7.1(High)

Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file

CWE-3472023