CVE-2021-3702

Katalog CVE

CVSS 6.3 · Medium EPSS 0,20%

Kerentanan Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') pada redhat ansible runner. Skor CVSS 3.1 6.3 (Medium) menurut NVD.

Deskripsi (NVD)

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

Rincian

Terbit di NVD

23 Agustus 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.3 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,20% peluang dieksploitasi; lebih tinggi dari 9,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2021-3702 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=1977965 issue tracking · patch · advisory vendor
• https://github.com/ansible/ansible-runner/pull/742/commits patch · advisory pihak ketiga