PatchTheCVECVE-2020-10685: A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.
30
Routine
MEDIUM 5.0WATCHLISTUPGRADEUPGRADEDOWNGRADE
CVE-2020-10685 is a medium-severity flaw (CVSS 5.0) affecting ansible engine, ansible tower, ceph storage. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmp
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.0 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | Required |
| EPSS exploit chance | 0.4% (top 70%) |
| CISA exploited list | No |
| Weakness | CWE-459 |
| Published | 2020-05-11 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
redhat ansible engine UPGRADE
Affected: >= 2.7.0 and < 2.7.17 · >= 2.8.0 and < 2.8.11 · >= 2.9.0 and < 2.9.7
Fixed in: 2.7.17, 2.8.11, 2.9.7
Safe to downgrade to: a release before 2.7.0
1. Check installed version
apt-cache policy ansible-engine || rpm -q ansible-engine || ansible-engine --version
2. UPGRADE to 2.7.17 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade ansible-engine
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade ansible-engine
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 2.7.0 (Debian / Ubuntu)
apt-cache madison ansible-engine
sudo apt install ansible-engine=<VERSION_BEFORE_2.7.0>
sudo apt-mark hold ansible-engine
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list ansible-engine
sudo dnf downgrade ansible-engine-<VERSION_BEFORE_2.7.0>
sudo dnf versionlock add ansible-engine
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat ansible tower UPGRADE
Affected: <= 3.4.5 · >= 3.5.0 and <= 3.5.5 · >= 3.6.0 and <= 3.6.3
Fixed in: newer than 3.6.3
Safe to downgrade to: a release before 3.5.0
1. Check installed version
apt-cache policy ansible-tower || rpm -q ansible-tower || ansible-tower --version
2. UPGRADE to newer than 3.6.3 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade ansible-tower
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade ansible-tower
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
3. If no update is available yet, DOWNGRADE to a release before 3.5.0 (Debian / Ubuntu)
apt-cache madison ansible-tower
sudo apt install ansible-tower=<VERSION_BEFORE_3.5.0>
sudo apt-mark hold ansible-tower
3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list ansible-tower
sudo dnf downgrade ansible-tower-<VERSION_BEFORE_3.5.0>
sudo dnf versionlock add ansible-tower
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat ceph storage DOWNGRADE
Affected: 2.0 · 3.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 2.0
1. Check installed version
apt-cache policy ceph-storage || rpm -q ceph-storage || ceph-storage --version
2. No fixed release: DOWNGRADE to a release before 2.0 (Debian / Ubuntu)
apt-cache madison ceph-storage
sudo apt install ceph-storage=<VERSION_BEFORE_2.0>
sudo apt-mark hold ceph-storage
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list ceph-storage
sudo dnf downgrade ceph-storage-<VERSION_BEFORE_2.0>
sudo dnf versionlock add ceph-storage
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat openstack DOWNGRADE
Affected: 10 · 13 · 15
Fixed in: no fixed release known
Safe to downgrade to: a release before 10
1. Check installed version
apt-cache policy openstack || rpm -q openstack || openstack --version
2. No fixed release: DOWNGRADE to a release before 10 (Debian / Ubuntu)
apt-cache madison openstack
sudo apt install openstack=<VERSION_BEFORE_10>
sudo apt-mark hold openstack
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list openstack
sudo dnf downgrade openstack-<VERSION_BEFORE_10>
sudo dnf versionlock add openstack
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
redhat storage DOWNGRADE
Affected: 3.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 3.0
1. Check installed version
apt-cache policy storage || rpm -q storage || storage --version
2. No fixed release: DOWNGRADE to a release before 3.0 (Debian / Ubuntu)
apt-cache madison storage
sudo apt install storage=<VERSION_BEFORE_3.0>
sudo apt-mark hold storage
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list storage
sudo dnf downgrade storage-<VERSION_BEFORE_3.0>
sudo dnf versionlock add storage
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
debian debian linux MITIGATE
Affected: 10.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 10.0
Check your OS release
cat /etc/os-release; uname -r
Debian / Ubuntu
sudo apt update && sudo apt full-upgrade
RHEL / Amazon Linux / Fedora
sudo dnf upgrade --refresh
Windows
Install the latest cumulative update from Windows Update
If no patch exists yet
OS downgrades are not safe. Apply the vendor mitigation from the advisory and restrict exposure.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-10685?
ansible engine: upgrade to 2.7.17, 2.8.11, 2.9.7; ansible tower: upgrade to newer than 3.6.3; ceph storage: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-10685 being exploited?
CVE-2020-10685 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-10685 affect?
CVE-2020-10685 affects ansible engine, ansible tower, ceph storage. Severity is medium (CVSS 5.0). A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules whic
How urgent is CVE-2020-10685?
Priority 30/100. On your watchlist
Software pages
Ansible vulnerabilities · Debian vulnerabilities · HashiCorp Vault vulnerabilities · AWS vulnerabilities · OpenStack vulnerabilities · Ceph vulnerabilities
Related CVEs
- CVE-2021-3620 MEDIUM 5.5 DOWNGRADE UPGRADE A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansibl
- CVE-2021-3583 HIGH 7.1 DOWNGRADE UPGRADE A flaw was found in Ansible, where a user's controller is vulnerable to template injection
- CVE-2021-20228 HIGH 7.5 DOWNGRADE DOWNGRADE A flaw was found in the Ansible Engine 2.9.18, where sensitive info is not masked by default and is not protec
- CVE-2020-1753 MEDIUM 5.0 UPGRADE UPGRADE A security flaw was found in Ansible Engine, all Ansible 2.7.x versions prior to 2.7.17, all Ansible 2.8.x ver
- CVE-2020-1746 MEDIUM 5.0 UPGRADE UPGRADE A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before