GHSA-772j-xvf9-qpf5

Suggest an improvement
Source
https://github.com/advisories/GHSA-772j-xvf9-qpf5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/08/GHSA-772j-xvf9-qpf5/GHSA-772j-xvf9-qpf5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-772j-xvf9-qpf5
Aliases
Published
2022-08-24T00:00:29Z
Modified
2024-11-26T16:24:33.368862Z
Severity
  • 6.3 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator
  • 5.3 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
ansible-runner vulnerable to Race Condition
Details

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's privatedatadir the next time ansible-runner made use of the privatedatadir. The highest Threat out of this flaw is to integrity and confidentiality.

Database specific
{
    "nvd_published_at": "2022-08-23T16:15:00Z",
    "cwe_ids": [
        "CWE-362",
        "CWE-377"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-01T22:17:50Z"
}
References

Affected packages

PyPI / ansible-runner

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.0

Affected versions

2.*

2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0.0a1
2.1.0.0a2
2.1.0.0b1