CVE-2020-1736

PyPI/ansible CVE-2020-1736: low 3.3, EPSS 0.40%

Incorrect Permission Assignment for Critical Resource in Ansible

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: GHSA-x7jh-595q-wq82
• https://nvd.nist.gov/vuln/detail/CVE-2020-1736
• https://github.com/ansible/ansible/issues/67794
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1736
• https://github.com/advisories/GHSA-x7jh-595q-wq82
• https://github.com/ansible/ansible
• https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-8.yaml
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NYYQP2XJB2TTRP6AKWVMBSPB2DFJNKD
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPNZWBAUP4ZHUR6PO7U6ZXEKNCX62KZ7
• https://security.gentoo.org/glsa/202006-11

CVE-2020-1736 · published 2022-02-09T21:59:46Z · modified 2024-11-22T05:24:41.049539Z · JSON

PyPI/ansible CVE-2020-1736: unknown, EPSS 0.40%

A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does no

Action: Upgrade ansible to 2.7.17 or later.

pip install ansible==2.7.17

pip install ansible==2.8.9

pip install ansible==2.9.6

Affected

Fixed versions

Sources

• osv: PYSEC-2020-8
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1736
• https://github.com/ansible/ansible/issues/67794
• https://security.gentoo.org/glsa/202006-11
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2NYYQP2XJB2TTRP6AKWVMBSPB2DFJNKD/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BPNZWBAUP4ZHUR6PO7U6ZXEKNCX62KZ7/
• https://github.com/advisories/GHSA-x7jh-595q-wq82

CVE-2020-1736 · published 2020-03-16T16:15:00Z · modified 2023-11-08T04:02:40.966773Z · JSON