CVE-2020-10744: Race Condition
First published: Fri May 15 2020(Updated: )
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Ansible | >=2.7.0<=2.7.18 | |
| Redhat Ansible | >=2.8.0<=2.8.12 | |
| Redhat Ansible | >=2.9.0<=2.9.9 | |
| Redhat Ansible Tower | >=3.4.0<=3.4.5 | |
| Redhat Ansible Tower | >=3.5.0<=3.5.6 | |
| Redhat Ansible Tower | >=3.6.0<=3.6.4 | |
| pip/ansible | <2.9.12 | 2.9.12 |
| pip/ansible | >=2.10.0a1<2.10.0rc1 | 2.10.0rc1 |
| >=2.7.0<=2.7.18 | ||
| >=2.8.0<=2.8.12 | ||
| >=2.9.0<=2.9.9 | ||
| >=3.4.0<=3.4.5 | ||
| >=3.5.0<=3.5.6 | ||
| >=3.6.0<=3.6.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744
- https://nvd.nist.gov/vuln/detail/CVE-2020-10744
- https://github.com/ansible/ansible/issues/69782
- https://github.com/ansible/ansible/commit/77d0effcc5b2da1ef23e4ba32986a9759c27c10d
- https://github.com/ansible/ansible/commit/84afa8e90cd168ff13208c8eae3e533ce7e21e1f
- https://github.com/ansible/ansible/commit/ffd3757fc35468a97791e452e7f2d14c3e3fcb80
- https://github.com/advisories/GHSA-vp9j-rghq-8jhh (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-208.yaml
Frequently Asked Questions
What is CVE-2020-10744?
CVE-2020-10744 is a vulnerability in Ansible Engine and Ansible Tower that allows a race condition when running become_user from become directive, which can be exploited on systems using ACLs and FUSE filesystems.
What is the severity of CVE-2020-10744?
CVE-2020-10744 has a severity rating of medium.
How does CVE-2020-10744 affect Ansible?
CVE-2020-10744 affects Ansible Engine versions 2.7.0 to 2.7.18, 2.8.0 to 2.8.12, and 2.9.0 to 2.9.9, as well as Ansible Tower versions 3.4.0 to 3.4.5, 3.5.0 to 3.5.6, and 3.6.0 to 3.6.4.
How can I fix CVE-2020-10744?
To fix CVE-2020-10744, update Ansible Engine to version 2.7.19, 2.8.13, or 2.9.10, and update Ansible Tower to version 3.4.6, 3.5.7, or 3.6.5.
Where can I find more information about CVE-2020-10744?
You can find more information about CVE-2020-10744 on the Red Hat Bugzilla website.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-vp9j-rghq-8jhh
- alias/CVE-2020-10744
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/weakness
- agent/last-modified-date
- agent/description
- agent/author
- agent/event
- agent/softwarecombine
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- agent/tags
- agent/trending
- vendor/redhat
- canonical/redhat ansible
- version/redhat ansible/2.7.0
- version/redhat ansible/2.7.18
- version/redhat ansible/2.8.0
- version/redhat ansible/2.8.12
- version/redhat ansible/2.9.0
- version/redhat ansible/2.9.9
- canonical/redhat ansible tower
- version/redhat ansible tower/3.4.0
- version/redhat ansible tower/3.4.5
- version/redhat ansible tower/3.5.0
- version/redhat ansible tower/3.5.6
- version/redhat ansible tower/3.6.0
- version/redhat ansible tower/3.6.4
- package-manager/pip