CVEvulnerability

CVE-2020-10744

5.0 MEDIUM Published 2020-05-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-05-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.0 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS 3.1 ([email protected])
5.0 MEDIUM — CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS 2.0 ([email protected])
3.7 LOW — AV:L/AC:H/Au:N/C:P/I:P/A:P
Weaknesses
CWE-362, CWE-377

Description

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.

Affected configurations

• redhat ansible (>= 2.7.0 <= 2.7.18) • redhat ansible (>= 2.8.0 <= 2.8.12) • redhat ansible (>= 2.9.0 <= 2.9.9) • redhat ansible tower (>= 3.4.0 <= 3.4.5) • redhat ansible tower (>= 3.5.0 <= 3.5.6) • redhat ansible tower (>= 3.6.0 <= 3.6.4)

Related

Weakness · not in database (1)

Weakness · CWE (1)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness

References