CVE-2020-1736

Name of the Vulnerable Software and Affected Versions Ansible Engine versions 2.7.x through 2.9.x

Description A flaw was found in Ansible Engine when a file is moved using the atomic move primitive, as the file mode cannot be specified. This sets the destination file's world-readable if the destination file does not exist, and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data.

Recommendations For versions 2.7.x, 2.8.x, and 2.9.x, consider restricting file permissions to minimize the risk of sensitive data disclosure until a patch is available. As a temporary workaround, consider implementing additional access controls to sensitive files to prevent unauthorized access.