Medium severity · published May 15, 2020
CVE-2020-10744
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive
5.0
CVSS
0.3%
EPSS
No
On KEV
Description
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
Attack vector
Local
Complexity
High
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AN
Ansible · Redhat
2.7.0 through 2.7.18; 2.8.0 through 2.8.12; 2.9.0 through 2.9.9 · source: NVD
AT
Ansible Tower · Redhat
3.4.0 through 3.4.5; 3.5.0 through 3.5.6; 3.6.0 through 3.6.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10744
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10744
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744
More from Ansible
9.8
CVE-2014-4657
The safe_eval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions
9.8
CVE-2014-4678
The safe_eval function in Ansible before 1.6.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions
9.8
CVE-2014-4967
Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote attackers to execute arbitrary code by leveraging access to an Ansible managed host and providing…
9.8
CVE-2014-4966
Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings, and does not prevent remote data with "{{" substrings, which allows remote attackers to…
9.8
CVE-2017-7550
A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module