Vulnerability in Debian Linux
CVE-2020-1733
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.0 (Medium). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L.
EPSS exploit prediction
EPSS: 0.004 (32.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 32nd percentile — 32.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Debian Linux — versions 8.0, 10.0
- Fedoraproject Fedora — versions 30, 31, 32
- Red Hat Ansible — versions 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior
- Red Hat Ansible
- Red Hat Ansible Tower
- Red Hat Cloudforms Management Engine — versions 5.0
- Red Hat OpenStack — versions 13
Weakness classification (CWE)
Public proof-of-concept exploits
References
- bugzilla.redhat.com/show_bug.cgi (Issue Tracking, Vendor Advisory)
- github.com/ansible/ansible/issues/67791 (Exploit, Third Party Advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/… (vendor-advisory)
- lists.debian.org/debian-lts-announce/2020/05/msg00005.html (mailing-list, Mailing List, Third Party Advisory)
- security.gentoo.org/glsa/202006-11 (vendor-advisory, Third Party Advisory)
- www.debian.org/security/2021/dsa-4950 (vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-1733?
- CVE-2020-1733 is a medium-severity vulnerability in Debian Linux, classified under Insecure Temporary File. CVSS score: 5.0/10. Published 2020-03-11.
- How severe is CVE-2020-1733?
- Medium severity. CVSS v3 base score is 5.0 out of 10.
- Is CVE-2020-1733 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.