CVE-2020-10744: redhat ansible +1 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-10744

CVSS 5.0 · Medium EPSS 0,26%

Kerentanan Insecure Temporary File pada redhat ansible, redhat ansible tower. Skor CVSS 3.1 5.0 (Medium) menurut NVD.

Deskripsi (NVD)

An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from become directive. The provided fix is insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 as well as previous versions are affected and Ansible Tower 3.4.5, 3.5.6 and 3.6.4 as well as previous versions are affected.

Rincian

Terbit di NVD: 15 Mei 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.0 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-377: Insecure Temporary File
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
EPSS (30 hari): 0,26% peluang dieksploitasi; lebih tinggi dari 15,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
redhat	ansible	Versi 2.7.0 hingga 2.7.18
redhat	ansible	Versi 2.8.0 hingga 2.8.12
redhat	ansible	Versi 2.9.0 hingga 2.9.9
redhat	ansible tower	Versi 3.4.0 hingga 3.4.5
redhat	ansible tower	Versi 3.5.0 hingga 3.5.6
redhat	ansible tower	Versi 3.6.0 hingga 3.6.4

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744 issue tracking · advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.