CVE-2020-1733
CVSS V2 Low 3.7
CVSS V3 Medium 5
Description
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.
Overview
- CVE ID
- CVE-2020-1733
- Assigner
- secalert@redhat.com
- Vulnerability Status
- Analyzed
- Published Version
- 2020-03-11T19:15:13
- Last Modified Date
- 2022-04-25T17:37:05
Weakness Enumerations
CPE Configuration (Product)
CPE | Vulnerable | Operator | Version Start | Version End |
---|---|---|---|---|
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* | 1 | OR | 2.7.16 | |
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* | 1 | OR | 2.8.0 | 2.8.8 |
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* | 1 | OR | 2.9.0 | 2.9.5 |
cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:* | 1 | OR | 3.3.4 | |
cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:* | 1 | OR | 3.3.5 | 3.4.5 |
cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:* | 1 | OR | 3.5.0 | 3.5.5 |
cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:* | 1 | OR | 3.6.0 | 3.6.3 |
cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | 1 | OR | ||
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:L/AC:H/Au:N/C:P/I:P/A:P
- Access Vector
- LOCAL
- Access Compatibility
- HIGH
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- PARTIAL
- Availability Impact
- PARTIAL
- Base Score
- 3.7
- Severity
- LOW
- Exploitability Score
- 1.9
- Impact Score
- 6.4
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
- Attack Vector
- LOCAL
- Attack Compatibility
- HIGH
- Privileges Required
- LOW
- User Interaction
- REQUIRED
- Scope
- CHANGED
- Confidentiality Impact
- LOW
- Availability Impact
- LOW
- Base Score
- 5
- Base Severity
- MEDIUM
- Exploitability Score
- 0.8
- Impact Score
- 3.7
References
Reference URL | Reference Tags |
---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1733 | Issue Tracking Vendor Advisory |
https://github.com/ansible/ansible/issues/67791 | Exploit Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW/ | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/ | Mailing List Third Party Advisory |
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S/ | Mailing List Third Party Advisory |
https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html | Mailing List Third Party Advisory |
https://security.gentoo.org/glsa/202006-11 | Third Party Advisory |
https://www.debian.org/security/2021/dsa-4950 | Third Party Advisory |
Sources
Source Name | Source URL |
---|---|
NIST | https://nvd.nist.gov/vuln/detail/CVE-2020-1733 |
MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1733 |
History
Created | Old Value | New Value | Data Type | Notes |
---|---|---|---|---|
2022-04-04 00:38:55 | Added to TrackCVE | |||
2022-12-04 12:25:24 | 2020-03-11T19:15Z | 2020-03-11T19:15:13 | CVE Published Date | updated |
2022-12-04 12:25:24 | 2022-04-25T17:37:05 | CVE Modified Date | updated | |
2022-12-04 12:25:24 | Analyzed | Vulnerability Status | updated |