Read the docs
TI-2020-01677 Aliases CVE-2020-1733GHSA-g4mq-6fp5-qwcf

Race condition in Red Hat Ansible

Priority LOW 23CWE-377Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Partial Red Hat: 7 fixed, 6 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.

Why it matters now

EPSS 0.004 34th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial ansible (PyPI): 2.7.17, 2.8.11, 2.9.7Red Hat: 4 advisoriesRed Hat: 7 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Red HatAnsibleup to 2.7.17; up to 2.8.9; up to 2.9.6—No fix listedCNA
—ansible (PyPI)before 2.7.172.7.17Patch availableGHSA-g4mq-6fp5-qwcf
—ansible (PyPI)2.8.0a1 to before 2.8.112.8.11Patch availableGHSA-g4mq-6fp5-qwcf
—ansible (PyPI)2.9.0a1 to before 2.9.72.9.7Patch availableGHSA-g4mq-6fp5-qwcf
  • Ansible VendorRed Hat Affected up to 2.7.17; up to 2.8.9; up to 2.9.6 Fixed in — No fix listed CNA
  • ansible (PyPI) Vendor— Affected before 2.7.17 Fixed in 2.7.17 Patch available GHSA-g4mq-6fp5-qwcf
  • ansible (PyPI) Vendor— Affected 2.8.0a1 to before 2.8.11 Fixed in 2.8.11 Patch available GHSA-g4mq-6fp5-qwcf
  • ansible (PyPI) Vendor— Affected 2.9.0a1 to before 2.9.7 Fixed in 2.9.7 Patch available GHSA-g4mq-6fp5-qwcf

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:*up to 2.7.16; 2.8.0 to before 2.8.8; 2.9.0 – 2.9.5VulnerableRed Hat
cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:*up to 3.3.4; 3.3.5 – 3.4.5; 3.5.0 – 3.5.5; 3.6.0 – 3.6.3VulnerableRed Hat
cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:*5.0VulnerableRed Hat
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*13VulnerableRed Hat
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*8.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:redhat:ansible:*:*:*:*:*:*:*:* Versions up to 2.7.16; 2.8.0 to before 2.8.8; 2.9.0 – 2.9.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:ansible_tower:*:*:*:*:*:*:*:* Versions up to 3.3.4; 3.3.5 – 3.4.5; 3.5.0 – 3.5.5; 3.6.0 – 3.6.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:cloudforms_management_engine:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-g4mq-6fp5-qwcf ansible (PyPI) Fixed in 2.7.17 Advisory →
  • Fix · GHSA-g4mq-6fp5-qwcf ansible (PyPI) Fixed in 2.8.11 Advisory →
  • Fix · GHSA-g4mq-6fp5-qwcf ansible (PyPI) Fixed in 2.9.7 Advisory →

Red Hat 4 advisories

  • RHSA-2020:1543 Released 2020-04-22 · Red Hat rating Important
    Ansible security and bug fix update (2.8.11)
    • Red Hat Ansible Engine 2.8 for RHEL 7 Server ansible-2.8.11-1.el7ae
    • Red Hat Ansible Engine 2.8 for RHEL 8 ansible-2.8.11-1.el8ae
  • RHSA-2020:1544 Released 2020-04-22 · Red Hat rating Important
    Ansible security and bug fix update (2.7.17)
    • Red Hat Ansible Engine 2.7 for RHEL 7 Server ansible-2.7.17-1.el7ae
  • RHSA-2020:1542 Released 2020-04-22 · Red Hat rating Important
    Ansible security and bug fix update (2.9.7)
    • Red Hat Ansible Engine 2 for RHEL 7 ansible-2.9.7-1.el7ae, ansible-test-2.9.7-1.el7ae
    • Red Hat Ansible Engine 2 for RHEL 8 ansible-2.9.7-1.el8ae, ansible-test-2.9.7-1.el8ae
Show 1 more Red Hat advisories
  • RHSA-2020:1541 Released 2020-04-22 · Red Hat rating Important
    Ansible security and bug fix update (2.9.7)
    • Red Hat Ansible Engine 2.9 for RHEL 7 Server ansible-2.9.7-1.el7ae, ansible-test-2.9.7-1.el7ae
    • Red Hat Ansible Engine 2.9 for RHEL 8 ansible-2.9.7-1.el8ae, ansible-test-2.9.7-1.el8ae

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Ansible — FEDORA-2020-3990f03ba3

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2020-01696 Information disclosure in Red Hat AnsiblePriority LOW 25
    • TI-2020-01684 Information disclosure in Red Hat ansiblePriority LOW 22
    • TI-2020-01679 Path traversal in Red Hat ansiblePriority LOW 22
    Show all 4 records → Advisory →
  • Advisory ·

    Red Hat Ansible — FEDORA-2020-f80154b5b4

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2020-01696 Information disclosure in Red Hat AnsiblePriority LOW 25
    • TI-2020-01684 Information disclosure in Red Hat ansiblePriority LOW 22
    • TI-2020-01679 Path traversal in Red Hat ansiblePriority LOW 22
    Show all 4 records → Advisory →
Show 1 more group
  • Advisory ·

    Red Hat Ansible — FEDORA-2020-1b6ce91e37

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2020-01696 Information disclosure in Red Hat AnsiblePriority LOW 25
    • TI-2020-01684 Information disclosure in Red Hat ansiblePriority LOW 22
    • TI-2020-01679 Path traversal in Red Hat ansiblePriority LOW 22
    Show all 4 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Tower 3AffectedNo fix yet
Red Hat Ceph Storage 2AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Ansible Engine 2 for RHEL 7Fixed RHSA-2020:1542
Red Hat Ansible Engine 2 for RHEL 8Fixed RHSA-2020:1542
Red Hat Ansible Engine 2.7 for RHEL 7 ServerFixed RHSA-2020:1544
Red Hat Ansible Engine 2.8 for RHEL 7 ServerFixed RHSA-2020:1543
Red Hat Ansible Engine 2.8 for RHEL 8Fixed RHSA-2020:1543
Red Hat Ansible Engine 2.9 for RHEL 7 ServerFixed RHSA-2020:1541
Red Hat Ansible Engine 2.9 for RHEL 8Fixed RHSA-2020:1541
Not affected: 1 product
  • CloudForms Management Engine 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-1733
  2. 2026-10-03 Alias added: GHSA-g4mq-6fp5-qwcf

References

Exploit 1

Advisory 9

Other 8

  • TI-2016-07808 Improper input validation in Ansible CVSS 3.1HIGH 8.1
  • TI-2014-03853 Injection in Ansible CVSS 3.1CRITICAL 9.8
  • TI-2014-03839 The safe_eval function in Ansible before 1.5.4 does not properly restrict the code… CVSS 3.1CRITICAL 9.8
  • TI-2017-05191 Sensitive information in log files in Red Hat ansible CVSS 3.1CRITICAL 9.8
  • TI-2014-04077 Multiple argument injection vulnerabilities in Ansible before 1.6.7 allow remote… CVSS 3.1CRITICAL 9.8
  • TI-2014-04076 Ansible before 1.6.7 does not prevent inventory data with "{{" and "lookup" substrings… CVSS 3.1CRITICAL 9.8
See all 44 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences