CVE-2020-1740: debian debian_linux DEPRECATED: Insecure Temporary File
Vulnerability summary
CVE-2020-1740 is a medium (CVSS 4.7) DEPRECATED: Insecure Temporary File vulnerability in debian debian_linux. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 29.7% of scored vulnerabilities.
Not severe (CVSS 3.9, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 14 · Related 7Timeline
- 16-03-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
CVSS metrics
8 scores · 6 sources · 3 versions- CVE.orgCNA3.9LowCVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- OSV · AlpineEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · PypiEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated4.7MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.36%
Chance of exploitation in the next 30 days
Percentile
30%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.36% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-377DEPRECATED: Insecure Temporary FileThis entry has been deprecated. It was focused only on the affected resource (temporary file) and not the behavior or mistake that produced the insecure temporary file, which caused confusion and incorrect mappings.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Known conditions: local access, low-privilege account, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat4 products
- ansible< 2.7.17 | ≥ 2.8.0, < 2.8.11 | ≥ 2.9.0, < 2.9.7
- ansible_tower≤ 3.3.4 | ≥ 3.3.5, ≤ 3.4.5 | ≥ 3.5.0, ≤ 3.5.5 | ≥ 3.6.0, ≤ 3.6.3
- cloudforms_management_engine5.0
- openstack13
Alpine2 products
- ansible≥ 2.8.0, < 2.8.11-r0 | ≥ 2.8.0, < 2.9.7-r0 | ≥ 2.8.0, < 2.7.17-r0
- ansible-base< 2.9.7-r0
Debian2 products
- ansible< 2.9.7+dfsg-1
- debian_linuxEOL8.0 | 10.0
Fedoraproject1 product
- fedoraEOL30 | 31 | 32
PyPI1 product
- ansible< 2.7.17 | ≥ 2.8.0a1, < 2.8.11 | ≥ 2.9.0a1, < 2.9.7 | ≥ 2.9.0, < 2.9.6
Red hat1 product
- ansible2.7.x, 2.8.x, 2.9.x
Ubuntu1 product
- ansibleAll versions (No fix recorded)
7 vendors · 12 products
References
27 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1740X Refsource CONFIRMWEBREPORTIssue TrackingVendor Advisory
- github.com/ansible/ansible/issues/67798X Refsource CONFIRMWEBREPORTIssue TrackingThird Party Advisory
lists.debian.org/debian-lts-announce/2020/05/msg00005.htmlMailing ListX Refsource MLISTWEBThird Party Advisory
Show all 27 references
- github.com/ansible/ansiblePACKAGE