Ansible Engine/Ansible Tower Decryption /tmp temp file

entryeditHistoryDiffjsonxmlCTI

A vulnerability was found in Ansible Engine and Ansible Tower. It has been declared as problematic. Affected by this vulnerability is an unknown function of the file /tmp of the component Decryption Handler. Upgrading eliminates this vulnerability.

Timeline

The analysis of the timeline helps to identify the required approach and handling of single vulnerabilities and vulnerability collections. This overview makes it possible to see less important slices and more severe hotspots at a glance. Initiating immediate vulnerability response and prioritizing of issues is possible.

User

Field

Commit Conf

Approve Conf

ID	Commited	User	Field	Change	Remarks	Moderated	Reason	C
10524440	10/16/2020	VulD...	cve_cna	Red Hat, Inc.	nvd.nist.gov	10/16/2020	accepted	70
10524439	10/16/2020	VulD...	confirm_url	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10685	cve.mitre.org	10/16/2020	accepted	70
10072573	05/12/2020	VulD...	cve_nvd_summary	A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.	mitre.org	05/12/2020	accepted	100
10072572	05/12/2020	VulD...	cve_assigned	1584662400	mitre.org	05/12/2020	accepted	100
10072564	05/12/2020	VulD...	cvss3_nvd_a	N	nist.gov	05/12/2020	accepted	100
10072563	05/12/2020	VulD...	cvss3_nvd_i	N	nist.gov	05/12/2020	accepted	100
10072562	05/12/2020	VulD...	cvss3_nvd_c	H	nist.gov	05/12/2020	accepted	100
10072561	05/12/2020	VulD...	cvss3_nvd_s	U	nist.gov	05/12/2020	accepted	100
10072560	05/12/2020	VulD...	cvss3_nvd_ui	R	nist.gov	05/12/2020	accepted	100
10072559	05/12/2020	VulD...	cvss3_nvd_pr	L	nist.gov	05/12/2020	accepted	100
10072558	05/12/2020	VulD...	cvss3_nvd_ac	L	nist.gov	05/12/2020	accepted	100
10072557	05/12/2020	VulD...	cvss3_nvd_av	L	nist.gov	05/12/2020	accepted	100
10072535	05/12/2020	VulD...	cwe	377 (privilege escalation)		05/12/2020	accepted	100
10072580	05/12/2020	VulD...	cvss3_nvd_basescore	5.0	nist.gov	05/12/2020	accepted	90
10072579	05/12/2020	VulD...	cvss3_vuldb_rc	X		05/12/2020	accepted	90
10072578	05/12/2020	VulD...	cvss3_vuldb_rl	O		05/12/2020	accepted	90
10072577	05/12/2020	VulD...	cvss3_vuldb_e	X		05/12/2020	accepted	90
10072576	05/12/2020	VulD...	cvss2_vuldb_rc	ND		05/12/2020	accepted	90
10072575	05/12/2020	VulD...	cvss2_vuldb_rl	OF		05/12/2020	accepted	90
10072574	05/12/2020	VulD...	cvss2_vuldb_e	ND		05/12/2020	accepted	90