CVE-2020-10744
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.
Se ha encontrado una corrección incompleta para la corrección del fallo de ansible CVE-2020-1733: un directorio temporal no seguro cuando se ejecuta become_user desde become directive. La corrección proporcionada no es suficiente para impedir una condición de carrera en sistemas que usan ACLs y sistemas de archivos FUSE. Ansible Engine versiones 2.7.18, 2.8.12, y 2.9.9 así como las versiones previas están afectadas y Ansible Tower versioes 3.4.5, 3.5.6 y 3.6.4 así como las versiones previas están afectadas.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-03-20 CVE Reserved
- 2020-05-15 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- CWE-377: Insecure Temporary File
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744 | 2023-11-07 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Redhat Search vendor "Redhat" | Ansible Search vendor "Redhat" for product "Ansible" | >= 2.7.0 <= 2.7.18 Search vendor "Redhat" for product "Ansible" and version " >= 2.7.0 <= 2.7.18" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Ansible Search vendor "Redhat" for product "Ansible" | >= 2.8.0 <= 2.8.12 Search vendor "Redhat" for product "Ansible" and version " >= 2.8.0 <= 2.8.12" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Ansible Search vendor "Redhat" for product "Ansible" | >= 2.9.0 <= 2.9.9 Search vendor "Redhat" for product "Ansible" and version " >= 2.9.0 <= 2.9.9" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Ansible Tower Search vendor "Redhat" for product "Ansible Tower" | >= 3.4.0 <= 3.4.5 Search vendor "Redhat" for product "Ansible Tower" and version " >= 3.4.0 <= 3.4.5" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Ansible Tower Search vendor "Redhat" for product "Ansible Tower" | >= 3.5.0 <= 3.5.6 Search vendor "Redhat" for product "Ansible Tower" and version " >= 3.5.0 <= 3.5.6" | - |
Affected
| ||||||
Redhat Search vendor "Redhat" | Ansible Tower Search vendor "Redhat" for product "Ansible Tower" | >= 3.6.0 <= 3.6.4 Search vendor "Redhat" for product "Ansible Tower" and version " >= 3.6.0 <= 3.6.4" | - |
Affected
|