Skip to content
OpenAdvisories
Medium · 6.6 CVE-2021-3701 EUVD-2022-0004GHSA-wwch-cmqr-hhrmPYSEC-2022-43067

ansible-runner has default temporary files written to world R/W locations

Published Aug 23, 2022 · Updated Aug 3, 2024 · Assigned by redhat

Description

A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.

Affected products

VendorProductAffectedFixed
— ansible-runner Affects ansible-runner 2.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 ansible-runner 2.1.1-1 —
Debian 13 ansible-runner 2.1.1-1 —
Debian 12 ansible-runner 2.1.1-1 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI ansible-runner >= 2.0.0, < 2.1.0 2.1.0 GHSA-wwch-cmqr-hhrm

References