GitHub Advisoryadvisory · PyPI

GHSA-vp9j-rghq-8jhh Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible

LOW Published 2022-02-09 Modified 2024-11-18 Official page ↗
Aliases
CVE-2020-10744
Ecosystem
PyPI
Packages
ansible
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Weaknesses
CWE-362, CWE-377, CWE-668
Reviewed
2021-04-05

Affected packages

• PyPI ansible: >= 2.10.0a1, < 2.10.0rc1 → fixed in 2.10.0rc1 • PyPI ansible: < 2.9.12 → fixed in 2.9.12

Description

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2020-10744 An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from… vulnerability

Weakness · CWE (2)

  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization weakness
  • CWE-668 Exposure of Resource to Wrong Sphere weakness

References