CVE-2020-1733PYSEC-2020-5GHSA-G4MQ-6FP5-QWCF
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivi
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.7.17, 2.8.8, 2.9.6, 2.8.11, 2.9.7
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.
Timeline
- CVE published
- Record last updated
Affected versions
- Red Hat Ansible
Version range not reported
- ansiblePyPI
fixed in 2.7.17; From 2.8.0 · fixed in 2.8.8; From 2.9.0 · fixed in 2.9.6
- ansiblePyPI
fixed in 2.7.17
- ansiblePyPI
From 2.8.0a1 · fixed in 2.8.11
- ansiblePyPI
From 2.9.0a1 · fixed in 2.9.7