A vulnerability classified as problematic has been found in ansible-runner (the affected version unknown). This affects an unknown part of the component Temporary Directory Handler. The manipulation with an unknown input leads to a race condition vulnerability. CWE is classifying the issue as CWE-362. The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

The weakness was presented 08/24/2022. It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2021-3702 since 08/12/2021. The technical details are unknown and an exploit is not publicly available.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com.

Productinfo

Name

• ansible-runner

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion