Vulnerability · Published Aug 23, 2022 · Assigned by redhat

CVE-2021-3702

Medium 6.3

In plain English

A medium-severity race condition in ansible-runner. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.3Medium

Exploit odds (30 days)0.2%top 89.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	ansible-runner	2.1.0	GHSA-772j-xvf9-qpf5
PyPI	ansible-runner	2.1.0	PYSEC-2022-43068

Affected products (as reported)

Vendor	Product	Versions
n/a	ansible-runner	Affects ansible-runner 2.0

Weakness: CWE-362

References

https://github.com/ansible/ansible-runner/pull/742/commits x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1977965 x_refsource_MISC
https://access.redhat.com/security/cve/CVE-2021-3702 x_refsource_MISC