redhat ansible-engine CVE-2020-10685 in Red Hat and Debian Products
Published on May 11, 2020

product logo product logo
A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.

Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2020-10685 can be exploited with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
REQUIRED
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
NONE
Availability Impact:
NONE

Weakness Type

What is an Insufficient Cleanup Vulnerability?

The software does not properly "clean up" and remove temporary or supporting resources after they have been used.

CVE-2020-10685 has been classified to as an Insufficient Cleanup vulnerability or weakness.


Products Associated with CVE-2020-10685

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2020-10685 are published in these products:

Red Hat Ansible Engine
 
Red Hat Ansible Tower
 
Red Hat Ceph Storage
 
Red Hat Openstack
 
Red Hat Storage
 
Debian Linux
 

Affected Versions

Red Hat Ansible:

Exploit Probability

EPSS
0.19%
Percentile
40.60%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.