CVE-2020-10744: red hat ansible Insecure Temporary File
Vulnerability summary
CVE-2020-10744 is a medium (CVSS 5.0) Insecure Temporary File vulnerability in red hat ansible. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 15.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 4Timeline
- 15-05-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
CVSS metrics
7 scores · 5 sources · 3 versions- OSV · PypiEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
- OSV · UbuntuEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
- OSV · DebianEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
- NVDNIST5.0MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
EPSS trend
Probability
0.26%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
0.00 pp
From 0.26% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-377Insecure Temporary FileCreating and using insecure temporary files can leave application and system data vulnerable to attack.
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Affected systems
Redhat2 products
- ansible≥ 2.7.0, ≤ 2.7.18 | ≥ 2.8.0, ≤ 2.8.12 | ≥ 2.9.0, ≤ 2.9.9
- ansible_tower≥ 3.4.0, ≤ 3.4.5 | ≥ 3.5.0, ≤ 3.5.6 | ≥ 3.6.0, ≤ 3.6.4
Debian1 product
- ansible< 2.9.13+dfsg-1
PyPI1 product
- ansible≥ 2.10.0a1, < 2.10.0rc1 | < 2.9.12 | ≥ 2.9.0, < 2.9.10
Red hat1 product
- ansibleansible-engine 2.7.18 and prior | ansible-engine 2.8.12 and prior | ansible-engine 2.9.9 and prior | ansible-tower 3.4.5 and prior | ansible-tower 3.5.6 and prior | ansible-tower 3.6.4 and prior
Ubuntu1 product
- ansible< 2.0.0.2-2ubuntu1.3+esm1 | < 2.5.1+dfsg-1ubuntu0.1+esm1 | < 2.9.6+dfsg-1ubuntu0.1~esm1
5 vendors · 6 products
References
14 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744X Refsource CONFIRMWEBREPORTIssue TrackingVendor Advisory
- github.com/ansible/ansiblePACKAGE
