CVE-2020-1733

Name of the Vulnerable Software and Affected Versions Ansible Engine versions 2.7.17 and prior Ansible Engine versions 2.8.9 and prior Ansible Engine versions 2.9.6 and prior

Description The issue is related to a race condition flaw in Ansible Engine when running a playbook with an unprivileged become user. This flaw can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service. The vulnerability is associated with insecure temporary files created in /var/tmp. An attacker could exploit this by taking control of the become user, as the target directory can be retrieved by iterating '/proc//cmdline'.

Recommendations For Ansible Engine versions 2.7.17 and prior, update to a version that includes the fix for this issue. For Ansible Engine versions 2.8.9 and prior, update to a version that includes the fix for this issue. For Ansible Engine versions 2.9.6 and prior, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the temporary directory in /var/tmp to minimize the risk of exploitation.