CVE-2020-1740: Infoleak
A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method writedata is called to write the existing secret in the file. This method will delete the file before recreating it insecurely.
Other sources
When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created a temporary file with mkstemp and the returned file descriptor is closed and the method writedata is called to write the existing secret in the file. This method will delete the file before recreate it insecurely.
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.7.17-1.el7ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.8.11-1.el7ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.8.11-1.el8ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.9.7-1.el7ae - Upgrade
Upgrade
redhat/ansibleto a version that resolves this vulnerability.Fixed in 0:2.9.7-1.el8ae - Upgrade
Upgrade
debian/ansibleto a version that resolves this vulnerability.Fixed in 2.7.7+dfsg-1+deb10u1Fixed in 2.7.7+dfsg-1+deb10u2Fixed in 2.10.7+merged+base+2.10.8+dfsg-1Fixed in 7.3.0+dfsg-1Fixed in 7.7.0+dfsg-3 - Upgrade
Upgrade
redhat/ansible-engineto a version that resolves this vulnerability.Fixed in 2.7.17 - Upgrade
Upgrade
redhat/ansible-engineto a version that resolves this vulnerability.Fixed in 2.8.11 - Upgrade
Upgrade
redhat/ansible-engineto a version that resolves this vulnerability.Fixed in 2.9.7 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.9.7 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.8.11 - Upgrade
Upgrade
pip/ansibleto a version that resolves this vulnerability.Fixed in 2.7.17 - Configuration
Do not use the 'edit' option of the 'ansible-vault' command line tool, since during 'ansible-vault edit' it deletes and recreates the file insecurely and other users on the same computer may read the old/new secret from the temporary file.
ansible-vault command line tool ansible-vault edit usage = avoid
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-1740?
CVE-2020-1740 is a vulnerability found in Ansible Engine when using Ansible Vault for editing encrypted files.
What is the severity of CVE-2020-1740?
The severity of CVE-2020-1740 is low, with a severity value of 3.9.
Which software versions are affected by CVE-2020-1740?
Ansible versions 2.7.17-1.el7ae, 2.8.11-1.el7ae, 2.8.11-1.el8ae, 2.9.7-1.el7ae, and 2.9.7-1.el8ae are affected by CVE-2020-1740.
How can an attacker exploit CVE-2020-1740?
An attacker can exploit CVE-2020-1740 by executing "ansible-vault edit" on a system where another user can read the old and new secret.
Are there any references available for CVE-2020-1740?
Yes, you can find references for CVE-2020-1740 at the following links: [1] [2] [3].