VYPR
← All advisories
Moderate severityNVD Advisory· Published May 27, 2021· Updated Aug 4, 2024

CVE-2020-10729

CVE-2020-10729

Description

A flaw was found in the use of insufficiently random values in Ansible. Two random password lookups of the same length generate the equal value as the template caching action for the same file since no re-evaluation happens. The highest threat from this vulnerability would be that all passwords are exposed at once for the file. This flaw affects Ansible Engine versions before 2.9.6.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Ansible template caching reuses the same random password for lookups of equal length, exposing all passwords for a file.

Vulnerability

A flaw exists in Ansible Engine versions before 2.9.6 [1], where the template caching mechanism incorrectly caches Jinja2 expressions that have dynamic results, such as random password generation [1]. When two password lookup calls with the same length are made within the same file, the cached value from the first evaluation is reused, bypassing re-evaluation and thus generating equal passwords [2]. This affects any Ansible playbook or template file that uses the password lookup plugin to generate passwords of equal length.

Exploitation

An attacker who can modify or control an Ansible playbook or template file that uses the password lookup plugin could trigger this behavior [3]. No special network position is required beyond the ability to execute Ansible tasks that use the vulnerable lookup. By having multiple password lookups with the same length, the attacker can cause all such lookups to return the same password value, making them predictable.

Impact

Successful exploitation leads to all passwords generated by the password lookup for the same file being identical [2]. This severely weakens security, as all generated passwords are effectively exposed at once, increasing the risk of unauthorized access to systems or services where those passwords are used [2]. The confidentiality impact is high, while integrity and availability remain unaffected.

Mitigation

The vulnerability is fixed in Ansible Engine version 2.9.6, which was released in February 2020 [1]. Users should upgrade to version 2.9.6 or later. There are no known workarounds for earlier versions; the fix addresses the caching issue by ensuring dynamic lookups are re-evaluated properly [1].

References
  1. ansible/changelogs/CHANGELOG-v2.9.rst at v2.9.6 · ansible/ansible
  2. NVD - CVE-2020-10729
  3. CVE-2020-10729 - GitHub Advisory Database

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
ansiblePyPI
< 2.9.62.9.6

Affected products

145

Patches

1
c520d70bf474

Templating: make sure only one variable results are cached (#67429)

https://github.com/ansible/ansibleFelix FonteinFeb 19, 2020via ghsa
commit
3 files changed · +18 −1
  • changelogs/fragments/67429-jinja2-caching.yml+2 −0 added
    @@ -0,0 +1,2 @@
+bugfixes:
+- "Templating - Ansible was caching results of Jinja2 expressions in some cases where these expressions could have dynamic results, like password generation (https://github.com/ansible/ansible/issues/34144)."
  • lib/ansible/template/__init__.py+1 −1 modified
    @@ -628,7 +628,7 @@ def template(self, variable, convert_bare=False, preserve_trailing_newlines=True
                         # we only cache in the case where we have a single variable
                         # name, to make sure we're not putting things which may otherwise
                         # be dynamic in the cache (filters, lookups, etc.)
-                        if cache:
+                        if cache and only_one:
                             self._cached_result[sha1_hash] = result
 
                 return result
  • test/integration/targets/templating_lookups/template_lookups/tasks/main.yml+15 −0 modified
    @@ -71,3 +71,18 @@
 - name: set with_dict
   shell: echo "{{ item.key + '=' + item.value  }}"
   with_dict: "{{ mydict }}"
+
+# BUG #34144 bad template caching
+
+- name: generate two random passwords
+  set_fact:
+    password1: "{{ lookup('password', '/dev/null length=20') }}"
+    password2: "{{ lookup('password', '/dev/null length=20') }}"
+    # If the passwords are generated randomly, the chance that they
+    # coincide is neglectable (< 1e-18 assuming 120 bits of randomness
+    # per password).
+
+- name: make sure passwords are not the same
+  assert:
+    that:
+      - password1 != password2

Vulnerability mechanics

Root cause

"The templating engine incorrectly cached the results of dynamic lookups, causing subsequent identical lookups to return the same cached value instead of a new random one."

Attack vector

An attacker can trigger this by defining multiple variables that utilize dynamic lookups, such as the `password` lookup, within the same template context. Because the templating engine incorrectly caches results for these expressions, subsequent lookups of the same length return the identical value instead of generating new random data [patch_id=16307]. This behavior leads to predictable password generation, potentially exposing multiple secrets [patch_id=16307].

Affected code

The vulnerability is located in `lib/ansible/template/__init__.py` within the `template` method. The logic incorrectly cached results of Jinja2 expressions, including dynamic lookups, when multiple variables were processed [patch_id=16307].

What the fix does

The patch modifies `lib/ansible/template/__init__.py` to ensure that caching only occurs when a single variable is being processed [patch_id=16307]. By adding the `only_one` condition to the cache check, the engine avoids caching dynamic expressions like lookups that should be re-evaluated [patch_id=16307]. This ensures that each call to a lookup function generates a unique, random value as expected [patch_id=16307].

Preconditions

  • configThe user must be using an Ansible Engine version before 2.9.6.
  • inputThe playbook must contain multiple dynamic lookups (e.g., password generation) within the same template context.

Generated on May 17, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.