3.9
Low
CVE-2020-1740 A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files
Description
A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ansible | Versions not published |
References
- bugzilla.redhat.com bugzilla.redhat.com
- github.com github.com
- FEDORA-2020-1b6ce91e37 lists.fedoraproject.org
- FEDORA-2020-3990f03ba3 lists.fedoraproject.org
- FEDORA-2020-f80154b5b4 lists.fedoraproject.org
- [debian-lts-announce] 20200505 [SECURITY] [DLA 2202-1] ansible security update lists.debian.org
- GLSA-202006-11 security.gentoo.org
- DSA-4950 www.debian.org
Timeline
- Published
- Last modified
Other CVEs of Ansible
The 29 CVEs of Ansible →
CVE-2020-14332
A flaw was found in the Ansible Engine when using module_args
5.5
Medium
CVE-2020-14330
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data…
5.0
Medium
CVE-2020-10744
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running…
5.0
Medium
CVE-2020-1746
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and…
5.0
Medium