CVE-2021-3702 — Race Condition in Redhat Ansible Runner

CWE-362 — Race ConditionCWE-377 — Insecure Temporary File12 documents6 sources
Severity
6.3MEDIUMNVD
EPSS
0.1%
top 67.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Ansible Runner
Timeline
PublishedAug 23
Latest updateAug 24

Description

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 1.0 | Impact: 5.2

Affected Packages1 packages

Patches

Patch: bugzilla.redhat.com ↗Patch: github.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

9
OSV
ansible-runner vulnerable to Race Condition↗2022-08-24
▶
GHSA
ansible-runner vulnerable to Race Condition↗2022-08-24
▶
CVEList
CVE-2021-3702: A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute↗2022-08-23
▶
OSV
CVE-2021-3702: A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute↗2022-08-23
▶
OSV
linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-ibm, linux-oracle, linux-oracle-5.4, linux-raspi, linux-↗2021-10-22
▶

📋Vendor Advisories

2
Red Hat
ansible-runner: Race condition with temporary files in tempfile.TemporaryDirectory()↗2021-06-26
▶
Debian
CVE-2021-3702: ansible-runner - A race condition flaw was found in ansible-runner, where an attacker could watch...↗2021
▶
CVE-2021-3702 — Race Condition in Redhat Ansible Runner | cvebase