An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
CVSS Details
- CVSS 3.1 Base Score: 5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade ansible | Jul 30, 2024 | May 15, 2020 |
| Freebsd | — | Upgrade py39-ansibleUpgrade py39-ansible28Upgrade py36-ansible27Upgrade py39-ansible27Upgrade py38-ansibleUpgrade py38-ansible28Upgrade py36-ansibleUpgrade py38-ansible27Upgrade py37-ansible27Upgrade py37-ansibleUpgrade py37-ansible28Upgrade py36-ansible28 | Nov 4, 2022 | May 5, 2021 |
| Suse | — | Upgrade POS_Image-JeOS7Upgrade golang-github-prometheus-promuUpgrade ansible-docUpgrade dracut-saltbootUpgrade spacecmdUpgrade ansible-testUpgrade ansibleUpgrade POS_Image-Graphical7 | Aug 9, 2024 | May 15, 2020 |
| Ubuntu | — | Upgrade ansible (Ubuntu Pro) | Mar 22, 2023 | May 15, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 15, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub