CVE-2020-14365

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disable_gpg_check is set to False, which is the default behavior. This flaw leads to malicious packages being installed on the system and arbitrary code executed via package installation scripts. The highest threat from this vulnerability is to integrity and system availability.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-347

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-143667.5A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources CVE-2020-143676.0A flaw was found in chrony versions before 3.5.1 when creating the PID file under the /var/run/chrony folder. The file is created during chr CVE-2020-143687.1A flaw was found in Eclipse Che in versions prior to 7.14.0 that impacts CodeReady Workspaces. When configured with cookies authentication, CVE-2020-143696.3This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted act CVE-2020-14377.8An elevation of privilege vulnerability exists in the way that the Windows Network Location Awareness Service handles objects in memory, aka CVE-2020-143705.3An information disclosure vulnerability was found in containers/podman in versions before 2.0.5. When using the deprecated Varlink API or th CVE-2020-143716.5A credential leak vulnerability was found in Red Hat Satellite. This flaw exposes the compute resources credentials through VMs that are run CVE-2020-143727.5A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled.CVE-2020-143735.5A use after free was found in igc_reloc_struct_ptr() of psi/igc.c of ghostscript-9.25. A local attacker could supply a specially crafted PDF CVE-2020-143748.8A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A flawed bounds checking in the copy_data function leads to a buffe CVE-2020-143757.8A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. Virtio ring descriptors, and the data they describe are in a region CVE-2020-143767.8A flaw was found in dpdk in versions before 18.11.10 and before 19.11.5. A lack of bounds checking when copying iv_data from the VM guest me