CVE-2020-1736: Low severity redhat ansible vulnerability
A flaw was found in Ansible Engine when a file is moved using atomicmove primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-1736?
CVE-2020-1736 is a vulnerability found in Ansible Engine that allows destination files to become world-readable.
How does the vulnerability in CVE-2020-1736 occur?
The vulnerability occurs when a file is moved using the atomic_move primitive without specifying the file mode.
What is the severity of CVE-2020-1736?
CVE-2020-1736 has a severity rating of low (3.3).
Which software versions are affected by CVE-2020-1736?
Versions 2.7.16 to 2.9.13 of Redhat Ansible, versions 3.3.4 to 3.7.2 of Redhat Ansible Tower, Redhat Cloudforms Management Engine 5.0, and Fedoraproject Fedora 31 and 32 are affected.
How can the vulnerability in CVE-2020-1736 be fixed?
To fix the vulnerability, update Ansible Engine to a version that is not affected by the issue.