Race Condition Affecting ansible package, versions [,2.7.17) [2.8.0,2.8.9) [2.9.0,2.9.6)
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PYTHON-ANSIBLE-559860
- published 12 Mar 2020
- disclosed 11 Mar 2020
- credit Unknown
Introduced: 11 Mar 2020
CVE-2020-1733 Open this link in a new tabHow to fix?
Upgrade ansible to version 2.7.17, 2.8.9, 2.9.6 or higher.
Overview
ansible is a simple IT automation system.
Affected versions of this package are vulnerable to Race Condition. A race condition flaw exists when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with umask 77 && mkdir -p <dir>;. This operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating /proc/<pid>/cmdline.