CVE-2020-10744

MEDIUM5.0

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive

Published May 15, 2020

Modified 1 years ago

Details

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.

References

WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744 ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2020-10744

CVSS Analysis

CVSS v3.1

5.0

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

HighAC:H

Privileges Required

LowPR:L

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

LowC:L

Integrity

LowI:L

Availability

LowA:L

5/CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Weakness Type (CWE)

Other

CWE-377

Ecosystems

Timeline

PublishedMay 15, 2020

ModifiedAug 4, 2024