PT-2020-12307 · Ansible+3 · Ansible Engine+5

Published 2020-05-15 · Updated 2024-05-06 · CVE-2020-10744

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Ansible Engine versions prior to 2.9.9 Ansible Tower versions prior to 3.6.4

Description The issue is related to an insecure temporary directory when running become user from the become directive. The provided fix is insufficient to prevent a race condition on systems using ACLs and FUSE filesystems.

Recommendations For Ansible Engine versions prior to 2.9.9, update to a version that includes a complete fix for the issue. For Ansible Tower versions prior to 3.6.4, update to a version that includes a complete fix for the issue. As a temporary workaround, consider restricting the use of the become user directive from the become directive until a complete patch is available.

Fix

Race Condition

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-362

CWE-668

CWE-377

Related Identifiers

ALT-PU-2020-2341

ALT-PU-2020-3006

ALT-PU-2021-1800

CVE-2020-10744

GHSA-VP9J-RGHQ-8JHH

PYSEC-2020-208

SUSE-SU-2020:2911-1

SUSE-SU-2020:3309-1

SUSE-SU-2024:1509-1

USN-5315-1

Affected Products

Alt Linux

Ansible-Core

Ansible Engine

Ansible Tower

Linuxmint

Ubuntu

References · 160

• https://osv.dev/vulnerability/USN-5315-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-10744 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3309-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-10744 · Security Note
• https://ubuntu.com/security/CVE-2020-10744 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vp9j-rghq-8jhh · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-1733 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2024:1509-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10744 · Security Note
• https://ubuntu.com/security/CVE-2021-3583 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-10744 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3620 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-208 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-10744 · Vendor Advisory