GoogleOSV:GHSA-G4MQ-6FP5-QWCFExposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible
0.001 Low
EPSS
Percentile
39.0%
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with “umask 77 && mkdir -p <dir>”; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating ‘/proc/<pid>/cmdline’.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1733
github.com/ansible/ansible
github.com/ansible/ansible/issues/67791
lists.debian.org/debian-lts-announce/2020/05/msg00005.html
lists.fedoraproject.org/archives/list/[email protected]/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW
lists.fedoraproject.org/archives/list/[email protected]/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S
lists.fedoraproject.org/archives/list/[email protected]/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB
nvd.nist.gov/vuln/detail/CVE-2020-1733
security.gentoo.org/glsa/202006-11
www.debian.org/security/2021/dsa-4950
Related
