// For flags

CVE-2020-10744

 

Severity Score

5.0
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.

Se ha encontrado una corrección incompleta para la corrección del fallo de ansible CVE-2020-1733: un directorio temporal no seguro cuando se ejecuta become_user desde become directive. La corrección proporcionada no es suficiente para impedir una condición de carrera en sistemas que usan ACLs y sistemas de archivos FUSE. Ansible Engine versiones 2.7.18, 2.8.12, y 2.9.9 así como las versiones previas están afectadas y Ansible Tower versioes 3.4.5, 3.5.6 y 3.6.4 así como las versiones previas están afectadas.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
High
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
Low
Attack Vector
Local
Attack Complexity
High
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-03-20 CVE Reserved
  • 2020-05-15 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
  • CWE-377: Insecure Temporary File
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Redhat
Search vendor "Redhat"
Ansible
Search vendor "Redhat" for product "Ansible"
>= 2.7.0 <= 2.7.18
Search vendor "Redhat" for product "Ansible" and version " >= 2.7.0 <= 2.7.18"
-
Affected
Redhat
Search vendor "Redhat"
Ansible
Search vendor "Redhat" for product "Ansible"
>= 2.8.0 <= 2.8.12
Search vendor "Redhat" for product "Ansible" and version " >= 2.8.0 <= 2.8.12"
-
Affected
Redhat
Search vendor "Redhat"
Ansible
Search vendor "Redhat" for product "Ansible"
>= 2.9.0 <= 2.9.9
Search vendor "Redhat" for product "Ansible" and version " >= 2.9.0 <= 2.9.9"
-
Affected
Redhat
Search vendor "Redhat"
Ansible Tower
Search vendor "Redhat" for product "Ansible Tower"
>= 3.4.0 <= 3.4.5
Search vendor "Redhat" for product "Ansible Tower" and version " >= 3.4.0 <= 3.4.5"
-
Affected
Redhat
Search vendor "Redhat"
Ansible Tower
Search vendor "Redhat" for product "Ansible Tower"
>= 3.5.0 <= 3.5.6
Search vendor "Redhat" for product "Ansible Tower" and version " >= 3.5.0 <= 3.5.6"
-
Affected
Redhat
Search vendor "Redhat"
Ansible Tower
Search vendor "Redhat" for product "Ansible Tower"
>= 3.6.0 <= 3.6.4
Search vendor "Redhat" for product "Ansible Tower" and version " >= 3.6.0 <= 3.6.4"
-
Affected