CVE-2020-1736
LOW3.3EPSS 0.06%Incorrect Permission Assignment for Critical Resource in Ansible
發布日:2022/2/9修改日:2026/4/28
也稱為:DEBIAN-CVE-2020-1736
描述
A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
受影響套件(3)
- Debian/ansiblefrom 0
- PyPI/ansible>= 2.7.0, <= 2.10.0
- PyPI/ansiblefrom 0, < 2.7.17, >= 2.8.0, < 2.8.9, >= 2.9.0, < 2.9.6
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
| osv | CVSS 3.1 | LOW3.3 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
參考連結(12)
- ADVISORYhttps://github.com/advisories/GHSA-x7jh-595q-wq82
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2020-1736
- ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2020-1736
- PATCHhttps://github.com/ansible/ansible
- WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1736
- WEBhttps://github.com/ansible/ansible/issues/67794
- WEBhttps://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-8.yaml
- WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/2NYYQP2XJB2TTRP6AKWVMBSPB2DFJNKD
- WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/2NYYQP2XJB2TTRP6AKWVMBSPB2DFJNKD/
- WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/BPNZWBAUP4ZHUR6PO7U6ZXEKNCX62KZ7
- WEBhttps://lists.fedoraproject.org/archives/list/[email protected]/message/BPNZWBAUP4ZHUR6PO7U6ZXEKNCX62KZ7/
- WEBhttps://security.gentoo.org/glsa/202006-11