An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
CVSS Details
- CVSS 3.1 Base Score: 5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ansible | Jul 30, 2024 | May 15, 2020 |
| Freebsd | — | Upgrade py39-ansible27Upgrade py36-ansible27Upgrade py39-ansible28Upgrade py39-ansibleUpgrade py38-ansibleUpgrade py37-ansible27Upgrade py37-ansibleUpgrade py38-ansible28Upgrade py37-ansible28Upgrade py38-ansible27Upgrade py36-ansible28Upgrade py36-ansible | Nov 4, 2022 | May 5, 2021 |
| Suse | — | Upgrade golang-github-prometheus-promuUpgrade POS_Image-JeOS7Upgrade spacecmdUpgrade POS_Image-Graphical7Upgrade ansibleUpgrade ansible-docUpgrade ansible-testUpgrade dracut-saltboot | Aug 9, 2024 | May 15, 2020 |
| Ubuntu | — | Upgrade ansible (Ubuntu Pro) | Mar 22, 2023 | May 15, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 15, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub