CVE-2020-10744: Race Condition
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
Other sources
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running becomeuser from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-10744?
CVE-2020-10744 is a vulnerability in Ansible Engine and Ansible Tower that allows a race condition when running become_user from become directive, which can be exploited on systems using ACLs and FUSE filesystems.
What is the severity of CVE-2020-10744?
CVE-2020-10744 has a severity rating of medium.
How does CVE-2020-10744 affect Ansible?
CVE-2020-10744 affects Ansible Engine versions 2.7.0 to 2.7.18, 2.8.0 to 2.8.12, and 2.9.0 to 2.9.9, as well as Ansible Tower versions 3.4.0 to 3.4.5, 3.5.0 to 3.5.6, and 3.6.0 to 3.6.4.
How can I fix CVE-2020-10744?
To fix CVE-2020-10744, update Ansible Engine to version 2.7.19, 2.8.13, or 2.9.10, and update Ansible Tower to version 3.4.6, 3.5.7, or 3.6.5.
Where can I find more information about CVE-2020-10744?
You can find more information about CVE-2020-10744 on the Red Hat Bugzilla website.