CVE-2021-3701
published 2022-08-23CVE-2021-3701: A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an…
PriorityP432medium6.6CVSS 3.1
AVLACLPRLUIRSUCHIHAN
EPSS
0.26%
18.0th percentile
A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ansible-runner | < ansible-runner 2.1.1-1 (bookworm) | ansible-runner 2.1.1-1 (bookworm) |
| redhat | ansible_runner | — | — |
CVSS provenance
nvdv3.16.6MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
osv6.6MEDIUM
vendor_debian6.6MEDIUM
vendor_redhat6.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ansible-runner: Artifacts are written to world rw location by default
vendor_redhat·2021-06-23·CVSS 6.6
CVE-2021-3701 [MEDIUM] CWE-276 ansible-runner: Artifacts are written to world rw location by default
ansible-runner: Artifacts are written to world rw location by default
A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.
A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they di
Debian
CVE-2021-3701: ansible-runner - A flaw was found in ansible-runner where the default temporary files configurati...
vendor_debian·2021·CVSS 6.6
CVE-2021-3701 [MEDIUM] CVE-2021-3701: ansible-runner - A flaw was found in ansible-runner where the default temporary files configurati...
A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.
Scope: local
bookworm: resolved (fixed in 2.1.1-1)
forky: resolved (fixed in 2.1.1-1)
sid: resolved (fixed in 2.1.1-1)
trixie: resolved (fixed in 2.1.1-1)
GHSA
ansible-runner has default temporary files written to world R/W locations
ghsa·2022-08-24
CVE-2021-3701 [MEDIUM] CWE-276 ansible-runner has default temporary files written to world R/W locations
ansible-runner has default temporary files written to world R/W locations
A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.
OSV
ansible-runner has default temporary files written to world R/W locations
osv·2022-08-24
CVE-2021-3701 [MEDIUM] ansible-runner has default temporary files written to world R/W locations
ansible-runner has default temporary files written to world R/W locations
A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.
OSV
CVE-2021-3701: A flaw was found in ansible-runner where the default temporary files configuration in ansible-2
osv·2022-08-23·CVSS 6.6
CVE-2021-3701 [MEDIUM] CVE-2021-3701: A flaw was found in ansible-runner where the default temporary files configuration in ansible-2
A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://access.redhat.com/security/cve/CVE-2021-3701https://bugzilla.redhat.com/show_bug.cgi?id=1977959https://github.com/ansible/ansible-runner/issues/738https://github.com/ansible/ansible-runner/pull/742/commitshttps://access.redhat.com/security/cve/CVE-2021-3701https://bugzilla.redhat.com/show_bug.cgi?id=1977959https://github.com/ansible/ansible-runner/issues/738https://github.com/ansible/ansible-runner/pull/742/commits
2022-08-23
Published