CVE-2020-1736 : A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified

A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.

Published 2020-03-16 16:15:14

Updated 2022-04-05 15:00:32

Source Red Hat, Inc.

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-1736

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 31 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-1736

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
2.2	LOW	CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N	0.8	1.4	Red Hat, Inc.
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: Required Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
3.3	LOW	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	1.8	1.4	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2020-1736

CWE-732 Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

Assigned by:

nvd@nist.gov (Primary)
secalert@redhat.com (Secondary)

References for CVE-2020-1736

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NYYQP2XJB2TTRP6AKWVMBSPB2DFJNKD/

[SECURITY] Fedora 31 Update: ansible-2.9.12-1.fc31 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://security.gentoo.org/glsa/202006-11

Ansible: Multiple vulnerabilities (GLSA 202006-11) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPNZWBAUP4ZHUR6PO7U6ZXEKNCX62KZ7/

[SECURITY] Fedora 32 Update: ansible-2.9.13-1.fc32 - package-announce - Fedora Mailing-Lists
Mailing List;Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1736

1802124 – (CVE-2020-1736) CVE-2020-1736 ansible: atomic_move primitive sets permissive permissions
Issue Tracking;Vendor Advisory
https://github.com/ansible/ansible/issues/67794

The default permissions used by atomic_move create files that are world readable · Issue #67794 · ansible/ansible · GitHub
Exploit;Issue Tracking;Third Party Advisory

Products affected by CVE-2020-1736

Redhat » Openstack » Version: 13
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*
Matching versions
Redhat » Cloudforms Management Engine » Version: 5.0
cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*
Matching versions
Redhat » Ansible Tower
Versions from including (>=) 3.6.0 and up to, including, (<=) 3.6.3
cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
Matching versions
Redhat » Ansible Tower
Versions from including (>=) 3.3.5 and up to, including, (<=) 3.4.5
cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
Matching versions
Redhat » Ansible Tower
Versions up to, including, (<=) 3.3.4
cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
Matching versions
Redhat » Ansible Tower
Versions from including (>=) 3.7.0 and up to, including, (<=) 3.7.2
cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
Matching versions
Redhat » Ansible Tower
Versions from including (>=) 3.5.0 and up to, including, (<=) 3.5.5
cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*
Matching versions
Redhat » Ansible
Versions from including (>=) 2.8.0 and before (<) 2.8.15
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
Matching versions
Redhat » Ansible
Versions up to, including, (<=) 2.7.16
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
Matching versions
Redhat » Ansible
Versions from including (>=) 2.9.0 and before (<) 2.9.13
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 31
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 32
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2020-1736

Exploit prediction scoring system (EPSS) score for CVE-2020-1736

CVSS scores for CVE-2020-1736

CWE ids for CVE-2020-1736

References for CVE-2020-1736

Products affected by CVE-2020-1736