GHSA-vcg8-98q8-g7mj
Exposure of Sensitive Information to an Unauthorized Actor and Insecure Temporary File in Ansible
At a glance
- Published
- Updated
- CVE
- CVE-2020-1740
- Aliases
- PYSEC-2020-12
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS_V4
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Description
A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Affected packages
| Package | Versions |
|---|---|
| PyPI · ansible | introduced 0, fixed 2.7.17 |
| PyPI · ansible | introduced 2.8.0a1, fixed 2.8.11 |
| PyPI · ansible | introduced 2.9.0a1, fixed 2.9.7 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-1740 ADVISORY
- https://github.com/ansible/ansible/issues/67798 WEB
- https://github.com/ansible/ansible/commit/28f9fbdb5e281976e33f443193047068afb97a9b WEB
- https://github.com/ansible/ansible/commit/2a563514f070a0a8ba64aebf6bce21194be96c73 WEB
- https://github.com/ansible/ansible/commit/685a4b6d3ff72186d2b4ffce73172a5446a71ccc WEB
- https://github.com/ansible/ansible/commit/ef32a5bf96a89107986375516285253c1380d7ef WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1740 WEB
- https://github.com/advisories/GHSA-vcg8-98q8-g7mj ADVISORY
- https://github.com/ansible/ansible PACKAGE
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-12.yaml WEB
- https://lists.debian.org/debian-lts-announce/2020/05/msg00005.html WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DKPA4KC3OJSUFASUYMG66HKJE7ADNGFW WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MRRYUU5ZBLPBXCYG6CFP35D64NP2UB2S WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB WEB
- https://security.gentoo.org/glsa/202006-11 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |