CVEvulnerability

CVE-2020-1736

3.3 LOW Published 2020-03-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-03-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
2.2 LOW — CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1 ([email protected])
3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-732

Description

A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Affected configurations

• redhat ansible (<= 2.7.16) • redhat ansible (>= 2.8.0 < 2.8.15) • redhat ansible (>= 2.9.0 < 2.9.13) • redhat ansible tower (<= 3.3.4) • redhat ansible tower (>= 3.3.5 <= 3.4.5) • redhat ansible tower (>= 3.5.0 <= 3.5.5) • redhat ansible tower (>= 3.6.0 <= 3.6.3) • redhat ansible tower (>= 3.7.0 <= 3.7.2) • redhat cloudforms management engine 5.0 • redhat openstack 13 • fedoraproject fedora 31 • fedoraproject fedora 32

Related

Weakness · CWE (1)

  • CWE-732 Incorrect Permission Assignment for Critical Resource weakness

References