Vulnerability Name:

CVE-2020-1733 (CCN-177755)

Assigned:2019-11-27
Published:2020-03-03
Updated:2022-04-25
Summary:A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.
CVSS v3 Severity:5.0 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L)
4.4 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:3.7 Low (CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.4 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-362
Vulnerability Consequences:Bypass Security
References:Source: MITRE
Type: CNA
CVE-2020-1733

Source: CCN
Type: Red Hat Bugzilla – Bug 1801735
(CVE-2020-1733) - CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive

Source: CONFIRM
Type: Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1733

Source: XF
Type: UNKNOWN
redhat-cve20201733-sec-bypass(177755)

Source: CCN
Type: ansible GIT Repository
Insecure creation of temporary directory for become_user #67791

Source: MISC
Type: Exploit, Third Party Advisory
https://github.com/ansible/ansible/issues/67791

Source: MLIST
Type: Mailing List, Third Party Advisory
[debian-lts-announce] 20200505 [SECURITY] [DLA 2202-1] ansible security update

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-3990f03ba3

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-f80154b5b4

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-1b6ce91e37

Source: GENTOO
Type: Third Party Advisory
GLSA-202006-11

Source: DEBIAN
Type: Third Party Advisory
DSA-4950

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redhat:ansible:*:*:*:*:*:*:*:* (Version <= 2.7.16)
  • OR cpe:/a:redhat:ansible:*:*:*:*:*:*:*:* (Version >= 2.8.0 and < 2.8.8)
  • OR cpe:/a:redhat:ansible:*:*:*:*:*:*:*:* (Version >= 2.9.0 and <= 2.9.5)
  • OR cpe:/a:redhat:ansible_tower:*:*:*:*:*:*:*:* (Version <= 3.3.4)
  • OR cpe:/a:redhat:ansible_tower:*:*:*:*:*:*:*:* (Version >= 3.3.5 and <= 3.4.5)
  • OR cpe:/a:redhat:ansible_tower:*:*:*:*:*:*:*:* (Version >= 3.5.0 and <= 3.5.5)
  • OR cpe:/a:redhat:ansible_tower:*:*:*:*:*:*:*:* (Version >= 3.6.0 and <= 3.6.3)
  • OR cpe:/a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:openstack:13:*:*:*:*:*:*:*

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:30:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:31:*:*:*:*:*:*:*
  • OR cpe:/o:fedoraproject:fedora:32:*:*:*:*:*:*:*

    • Configuration 3:
  • cpe:/o:debian:debian_linux:8.0:*:*:*:*:*:*:*
  • OR cpe:/o:debian:debian_linux:10.0:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:redhat:ansible_engine:2.7.16:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:ansible_engine:2.8.8:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:ansible_engine:2.9.5:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:ansible_tower:3.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:ansible_tower:3.4.5:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:ansible_tower:3.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:ansible_tower:3.6.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20201733
    V
    		CVE-2020-1733
    2022-06-30
    oval:org.opensuse.security:def:111931
    P
    		ansible-2.9.24-1.2 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:34052
    P
    		Security update for net-snmp (Important)
    2022-01-05
    oval:org.opensuse.security:def:34050
    P
    		Security update for java-1_8_0-ibm (Important) (in QA)
    2022-01-04
    oval:org.opensuse.security:def:34013
    P
    		Security update for glib-networking (Important)
    2021-12-13
    oval:org.opensuse.security:def:34011
    P
    		Security update for MozillaFirefox (Important)
    2021-12-12
    oval:org.opensuse.security:def:33749
    P
    		Security update for webkit2gtk3 (Important)
    2021-12-01
    oval:org.opensuse.security:def:33747
    P
    		Security update for xen (Moderate)
    2021-12-01
    oval:org.opensuse.security:def:58038
    P
    		Security update for qemu (Important)
    2021-11-10
    oval:org.opensuse.security:def:105499
    P
    		ansible-2.9.24-1.2 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:33964
    P
    		Security update for unrar (Moderate)
    2021-08-25
    oval:org.opensuse.security:def:60340
    P
    		Security update for openssl-1_1 (Important)
    2021-08-24
    oval:org.opensuse.security:def:33962
    P
    		Security update for openssl-1_0_0 (Important)
    2021-08-24
    oval:org.opensuse.security:def:57479
    P
    		Security update for systemd (Important)
    2021-07-21
    oval:org.opensuse.security:def:57930
    P
    		Security update for the Linux Kernel (Live Patch 32 for SLE 12 SP3) (Important)
    2021-06-04
    oval:org.opensuse.security:def:33904
    P
    		Security update for avahi (Important)
    2021-06-03
    oval:org.opensuse.security:def:33659
    P
    		Security update for libwebp (Critical)
    2021-06-02
    oval:org.opensuse.security:def:33906
    P
    		Security update for python3 (Important)
    2021-05-17
    oval:org.opensuse.security:def:30072
    P
    		Security update for bind (Important)
    2021-05-04
    oval:org.opensuse.security:def:30070
    P
    		Security update for samba (Important)
    2021-04-29
    oval:org.opensuse.security:def:29351
    P
    		Security update for MozillaFirefox (Important)
    2021-04-27
    oval:org.opensuse.security:def:29482
    P
    		Security update for wpa_supplicant (Important)
    2021-03-09
    oval:org.opensuse.security:def:59856
    P
    		Security update for python-cryptography (Important)
    2021-03-02
    oval:org.opensuse.security:def:30028
    P
    		Security update for krb5-appl (Important)
    2021-02-19
    oval:org.opensuse.security:def:60456
    P
    		Security update for tomcat (Moderate)
    2021-02-19
    oval:org.opensuse.security:def:30026
    P
    		Security update for bind (Important)
    2021-02-18
    oval:org.opensuse.security:def:60300
    P
    		Security update for postgresql, postgresql12, postgresql13 (Important)
    2021-01-26
    oval:org.opensuse.security:def:30007
    P
    		Security update for ImageMagick (Important)
    2021-01-22
    oval:org.opensuse.security:def:30009
    P
    		Security update for openssh (Moderate)
    2021-01-05
    oval:org.opensuse.security:def:61058
    P
    		Security update for openexr (Moderate)
    2020-12-23
    oval:org.opensuse.security:def:29626
    P
    		Security update for bzip2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:60815
    P
    		Security update for python3 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34799
    P
    		Security update for ansible (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56962
    P
    		Security update for freerdp (Important)
    2020-12-01
    oval:org.opensuse.security:def:60718
    P
    		Security update for python3-requests (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34759
    P
    		Security update for MozillaFirefox (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33279
    P
    		vino on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60600
    P
    		Security update for postgresql10 (Important)
    2020-12-01
    oval:org.opensuse.security:def:34121
    P
    		Security update for ncurses (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34077
    P
    		Security update for libxslt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60111
    P
    		Security update for the Linux Kernel (Live Patch 30 for SLE 12 SP2) (Important)
    2020-12-01
    oval:org.opensuse.security:def:29569
    P
    		Security update for SDL (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30745
    P
    		Security update for ansible, python-straight-plugin (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56822
    P
    		Security update for ghostscript (Important)
    2020-12-01
    oval:org.opensuse.security:def:30708
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:33278
    P
    		unzip on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29968
    P
    		Security update for libproxy
    2020-12-01
    oval:org.opensuse.security:def:58273
    P
    		Security update for python (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:56800
    P
    		Security update for qemu (Important)
    2020-12-01
    oval:org.opensuse.security:def:29919
    P
    		Security update for libevent
    2020-12-01
    oval:org.opensuse.security:def:58323
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:29864
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:58242
    P
    		Security update for sssd (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29711
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:58204
    P
    		Security update for clamav (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33602
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:58130
    P
    		Security update for python-Pillow (Important)
    2020-12-01
    oval:org.opensuse.security:def:30747
    P
    		Security update for ansible (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30710
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:56799
    P
    		Security update for ucode-intel (Important)
    2020-12-01
    oval:org.opensuse.security:def:57645
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:60790
    P
    		Security update for ansible, ardana-ansible, ardana-cinder, ardana-glance, ardana-mq, ardana-nova, ardana-osconfig, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-monasca-installer, openstack-neutron, openstack-nova, python-Django, python-Flask-Cors, python-Pillow, python-ardana-packager, python-keystoneclient, python-keystonemiddleware, python-kombu, python-straight-plugin, python-urllib3, release-notes-suse-openstack-cloud, storm, storm-kit, venv-openstack-cinder, venv-openstack-swift (Important)
    2020-12-01
    oval:org.opensuse.security:def:33506
    P
    		Security update for openslp
    2020-12-01
    oval:org.opensuse.security:def:29970
    P
    		Security update for libraptor
    2020-12-01
    oval:org.opensuse.security:def:60711
    P
    		Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:29280
    P
    		Security update for xorg-x11-libX11 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29921
    P
    		Security update for libexif
    2020-12-01
    oval:org.opensuse.security:def:60761
    P
    		Security update for java-1_8_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:29866
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:60672
    P
    		Security update for python-PyKMIP (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29713
    P
    		Security update for Mozilla Firefox
    2020-12-01
    oval:org.opensuse.security:def:60634
    P
    		Security update for openssl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57373
    P
    		Security update for icedtea-web
    2020-12-01
    oval:org.opensuse.security:def:60552
    P
    		sysvinit-tools on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34797
    P
    		Security update for ansible, python-straight-plugin (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33371
    P
    		Security update for compat-openssl097g
    2020-12-01
    oval:org.opensuse.security:def:34757
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:29269
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:34119
    P
    		Security update for ncurses (Important)
    2020-12-01
    oval:org.opensuse.security:def:60041
    P
    		Security update for bash (Important)
    2020-12-01
    oval:org.opensuse.security:def:34075
    P
    		Security update for libxml2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:57200
    P
    		Security update for compat-openssl097g
    2020-12-01
    oval:org.opensuse.security:def:60978
    P
    		Security update for java-1_8_0-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:33290
    P
    		xen on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:61028
    P
    		Security update for java-1_8_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:29268
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:60937
    P
    		Security update for galera-3, mariadb, mariadb-connector-c (Important)
    2020-12-01
    oval:org.opensuse.security:def:60899
    P
    		Security update for mariadb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:58348
    P
    		Security update for qemu (Moderate)
    2020-11-29
    oval:org.opensuse.security:def:84056
    P
    		Security update for ansible, ardana-ansible, ardana-cinder, ardana-glance, ardana-mq, ardana-nova, ardana-osconfig, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-monasca-installer, openstack-neutron, openstack-nova, python-Django, python-Flask-Cors, python-Pillow, python-ardana-packager, python-keystoneclient, python-keystonemiddleware, python-kombu, python-straight-plugin, python-urllib3, release-notes-suse-openstack-cloud, storm, storm-kit, venv-openstack-cinder, venv-openstack-swift (Important)
    2020-11-12
    oval:org.opensuse.security:def:84511
    P
    		Security update for ansible, ardana-ansible, ardana-cinder, ardana-glance, ardana-mq, ardana-nova, ardana-osconfig, crowbar-core, crowbar-openstack, documentation-suse-openstack-cloud, grafana, grafana-natel-discrete-panel, openstack-cinder, openstack-monasca-installer, openstack-neutron, openstack-nova, python-Django, python-Flask-Cors, python-Pillow, python-ardana-packager, python-keystoneclient, python-keystonemiddleware, python-kombu, python-straight-plugin, python-urllib3, release-notes-suse-openstack-cloud, storm, storm-kit, venv-openstack-cinder, venv-openstack-swift (Important)
    2020-11-12
    oval:com.ubuntu.bionic:def:202017330000000
    V
    		CVE-2020-1733 on Ubuntu 18.04 LTS (bionic) - medium.
    2020-03-11
    oval:com.ubuntu.xenial:def:202017330000000
    V
    		CVE-2020-1733 on Ubuntu 16.04 LTS (xenial) - medium.
    2020-03-11
    BACK
    redhat ansible *
    redhat ansible *
    redhat ansible *
    redhat ansible tower *
    redhat ansible tower *
    redhat ansible tower *
    redhat ansible tower *
    redhat cloudforms management engine 5.0
    redhat openstack 13
    fedoraproject fedora 30
    fedoraproject fedora 31
    fedoraproject fedora 32
    debian debian linux 8.0
    debian debian linux 10.0
    redhat ansible engine 2.7.16
    redhat ansible engine 2.8.8
    redhat ansible engine 2.9.5
    redhat ansible tower 3.3.4
    redhat ansible tower 3.4.5
    redhat ansible tower 3.5.5
    redhat ansible tower 3.6.3