PyPI/ansible-runner CVE-2021-3701: medium 6.6, EPSS 0.29%

ansible-runner has default temporary files written to world R/W locations

Action: Upgrade ansible-runner to 2.1.0 or later.

pip install ansible-runner==2.1.0

Affected

Fixed versions

Sources

• osv: GHSA-wwch-cmqr-hhrm
• https://nvd.nist.gov/vuln/detail/CVE-2021-3701
• https://github.com/ansible/ansible-runner/issues/738
• https://github.com/ansible/ansible-runner/pull/742
• https://github.com/ansible/ansible-runner/pull/742/commits
• https://access.redhat.com/security/cve/CVE-2021-3701
• https://bugzilla.redhat.com/show_bug.cgi?id=1977959
• https://github.com/ansible/ansible-runner
• https://github.com/pypa/advisory-database/tree/main/vulns/ansible-runner/PYSEC-2022-43067.yaml

CVE-2021-3701 · published 2022-08-24T00:00:29Z · modified 2024-11-26T16:24:13.436748Z · JSON