Bug 1956477

Summary:	ansible: race condition in ansible's async code leading to no_log values disclosure
Product:	[Other] Security Response	Reporter:	Tapas Jena <tjena>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	a.badger, asherlan, bcoca, davidn, dylan, gblomqui, jcammara, jhardy, jjoyce, jobarker, jschluet, kevin, lhh, lpeer, mabashia, maxim, mburns, mcepl, osapryki, patrick, relrod, rpetrell, sclewis, slinaber, smcdonal, tkuratom, tuxmealux+redhatbz
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory . When this occurs, there is a race condition on the managed machine. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async result data.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2024-01-09 11:29:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1959089, 1959090, 1959091, 1959092, 1959093, 1959094, 1959095, 1959096
Bug Blocks:	1887243, 1956499

Description Tapas Jena 2021-05-03 18:35:58 UTC

ANSIBLE_ASYNC_DIR defaults to ~/.ansible_async/ but is settable by the user. If the ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a World Writable Directory, for instance: ANSIBLE_ASYNC_DIR=/tmp/username-ansible-async/.

When this occurs, there is a race condition on the managed machine.  A malicious, low privileged account on the remote machine can pre-create /tmp/username-ansible-async and then use various attacks to access the async result data.

Comment 2 Tapas Jena 2021-05-10 17:02:10 UTC

Created ansible tracking bugs for this issue:

Affects: epel-all [bug 1959095]
Affects: fedora-all [bug 1959094]
Affects: openstack-rdo [bug 1959096]

Comment 4 Gianluca Gabrielli 2021-05-19 12:35:05 UTC

Hi all,
is there any available patch for that? Thanks