Log in Start free

Vulnerability · Published Mar 11, 2020 · Assigned by redhat

CVE-2020-1733

Medium 5.0

In plain English

A medium-severity security flaw in Ansible from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.0Medium
Exploit odds (30 days)0.4%top 65.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12ansible2.9.7+dfsg-1DEBIAN-CVE-2020-1733
Debian:13ansible2.9.7+dfsg-1DEBIAN-CVE-2020-1733
Debian:14ansible2.9.7+dfsg-1DEBIAN-CVE-2020-1733
PyPIansible2.7.17GHSA-g4mq-6fp5-qwcf
PyPIansible2.7.17, 2.8.8, 2.9.6PYSEC-2020-5
PyPIansible2.8.11GHSA-g4mq-6fp5-qwcf
PyPIansible2.9.7GHSA-g4mq-6fp5-qwcf

Affected products (as reported)

VendorProductVersions
Red Hat Ansible 2.7.17 and prior2.8.9 and prior2.9.6 and prior

Weakness: CWE-377 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

References