CVE-2020-10685: Medium severity redhat Ansible Engine vulnerability
A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, wincopy, awss3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.
Other sources
A flaw was found on Ansible Engine when using modules which decrypts vault files such as assemble, script, unarchive, wincopy, awss3 or copy modules. The temporary directory is created in /tmp leaves the secrets unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decrypted data remains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted is sensible.
When a module uses a file that was encrypted with vault, it doesn not remove the decrypted file in /tmp after its usage.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.7.17-1.el7ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.8.11-1.el7ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.8.11-1.el8ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.9.7-1.el7ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.9.7-1.el8ae - Upgrade
Upgrade
debian/ansibleto a version that resolves this vulnerability.Fixed in 2.7.7+dfsg-1+deb10u1Fixed in 2.7.7+dfsg-1+deb10u2Fixed in 2.10.7+merged+base+2.10.8+dfsg-1Fixed in 7.3.0+dfsg-1Fixed in 7.7.0+dfsg-3 - Upgrade
Upgrade
redhat/ansible-engineto a version that resolves this vulnerability.Fixed in 2.7.17 - Upgrade
Upgrade
redhat/ansible-engineto a version that resolves this vulnerability.Fixed in 2.8.11 - Upgrade
Upgrade
redhat/ansible-engineto a version that resolves this vulnerability.Fixed in 2.9.7 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.9.7 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.8.11 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.7.17 - Upgrade
Upgrade
Ansible Engineto a version that resolves this vulnerability.Fixed in 2.7.17 - Upgrade
Upgrade
Ansible Engineto a version that resolves this vulnerability.Fixed in 2.8.11 - Upgrade
Upgrade
Ansible Engineto a version that resolves this vulnerability.Fixed in 2.9.7 - Operational
Manually remove the decrypted temporary file from /tmp after every run, and clear decrypted data as soon as possible.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-10685?
CVE-2020-10685 is a vulnerability found in Ansible Engine when using modules which decrypt vault files.
Which versions of Ansible Engine are affected by CVE-2020-10685?
Ansible Engine versions 2.7.x before 2.7.17, 2.8.x before 2.8.11, and 2.9.x before 2.9.7 are affected.
What is the severity of CVE-2020-10685?
CVE-2020-10685 has a severity rating of medium.
How can I fix CVE-2020-10685?
To fix CVE-2020-10685, update Ansible Engine to version 2.7.17, 2.8.11, or 2.9.7.
Where can I find more information about CVE-2020-10685?
You can find more information about CVE-2020-10685 on the Red Hat Bugzilla website.