ALPINE-CVE-2020-1733

Advisory lineage Upstream: 1 Downstream: 0
Upstream
CVE-2020-1733
Published: 11 Mar 2020, 19:15
Last modified:19 Nov 2025, 06:17

Vulnerability Summary

Overall Risk (default)
low
20/100
CVSS Score
5 MEDIUM
3.1 (osv_alpine)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Mar 2020, 19:15
Published
Vulnerability first disclosed
19 Nov 2025, 06:17
Last Modified
Vulnerability information updated

Description

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L

Affected Systems

  • alpine•ansible

    < 2.8.11-r0 | < 2.9.7-r0 | < 2.9.7-r0 | < 2.7.17-r0

  • alpine•ansible-base

    < 2.9.7-r0 | < 2.9.7-r0

References (1)