CVE-2020-1733 - A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 - CVEs Blog

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with “umask 77 && mkdir -p

“; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating ‘/proc//cmdline’.

Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1733

Reference (s):

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1733
DEBIAN:DSA-4950
URL: https://www.debian.org/security/2021/dsa-4950
FEDORA:FEDORA-2020-1b6ce91e37
URL: https://lists.fedoraproject.org/archives/list/[email protected]/message/WQVOQD4VAIXXTVQAJKTN7NUGTJFE2PCB/

CVE-2020-1733 – A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9

Something Fresh

CVE-2004-1715 - Directory traversal vulnerability in MIMEsweeper for Web before 5.0.4 all

CVE-2020-27216 - In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 1

CVE-2020-27212 - STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect acce

What People Reading

CVE-2020-11610 - An issue was discovered in xdLocalStorage through 2.0.5. The postData() f

CVE-2020-27199 - The Magic Home Pro application 1.5.1 for Android allows Authentication By

CVE-2004-1715 - Directory traversal vulnerability in MIMEsweeper for Web before 5.0.4 all

CVE-2020-26806 - admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File

CVE-2020-25026 - The sf_event_mgt (aka Event management and registration) extension before

Categories

Partners

Just add here your partners image or promo text