Vulnerability Description
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Ansible | <= 2.7.16 |
| Redhat | Ansible Tower | <= 3.3.4 |
| Redhat | Cloudforms Management Engine | 5.0 |
| Redhat | Openstack | 13 |
| Fedoraproject | Fedora | 30 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1733Issue TrackingVendor Advisory
- https://github.com/ansible/ansible/issues/67791ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/05/msg00005.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202006-11Third Party Advisory
- https://www.debian.org/security/2021/dsa-4950Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1733Issue TrackingVendor Advisory
- https://github.com/ansible/ansible/issues/67791ExploitThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/05/msg00005.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://security.gentoo.org/glsa/202006-11Third Party Advisory
FAQ
What is CVE-2020-1733?
CVE-2020-1733 is a vulnerability with a CVSS score of 5.0 (MEDIUM). A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with b...
How severe is CVE-2020-1733?
CVE-2020-1733 has been rated MEDIUM with a CVSS base score of 5.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-1733?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Ansible, Redhat Ansible Tower, Redhat Cloudforms Management Engine, Redhat Openstack, Fedoraproject Fedora.