CVE-2021-3533: Race Condition
A flaw was found in Ansible if an ansible user sets ANSIBLEASYNCDIR to a subdirectory of a world writable directory. When this occurs, there is a race condition on the managed machine. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async result data. This flaw affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.
Other sources
Rejected reason: This vulnerability does not meet the criteria for a security vulnerability
— NVD
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-3533?
CVE-2021-3533 is a vulnerability found in Ansible that allows a malicious, non-privileged account to exploit a race condition and access the async results of the managed machine.
How does CVE-2021-3533 affect Ansible?
CVE-2021-3533 affects Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory, creating a race condition on the managed machine that can be exploited.
What is the severity of CVE-2021-3533?
CVE-2021-3533 has a severity rating of low (2.5).
Which software versions are affected by CVE-2021-3533?
Redhat Ansible Automation Platform 1.2, Redhat Ansible Tower 3.7.0, Redhat Ansible Engine 2.0, Redhat Ansible Tower 3.0, Redhat Enterprise Linux 7.0, Fedoraproject Fedora 34, and Redhat Openstack-rdo are affected by CVE-2021-3533.
How can the CVE-2021-3533 vulnerability be fixed?
To fix CVE-2021-3533, users should avoid setting ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory in Ansible.