Vulnerability Description
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Ansible | >= 2.7.0, <= 2.7.18 |
| Redhat | Ansible Tower | >= 3.4.0, <= 3.4.5 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744Issue TrackingVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744Issue TrackingVendor Advisory
FAQ
What is CVE-2020-10744?
CVE-2020-10744 is a vulnerability with a CVSS score of 5.0 (MEDIUM). An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the ...
How severe is CVE-2020-10744?
CVE-2020-10744 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-10744?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Ansible, Redhat Ansible Tower.