Bug 1977959 (CVE-2021-3701)

Summary:	CVE-2021-3701 ansible-runner: Artifacts are written to world rw location by default
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akarol, anharris, bbuckingham, bcoca, bcourt, bkearney, bmontgom, bniver, dblechte, dmetzger, eedri, ehelms, eparis, flucifre, gblomqui, gmccullo, gmeno, gtanzill, hvyas, jburrell, jcammara, jhardy, jjoyce, jobarker, jschluet, jsherril, lhh, lpeer, lzap, mabashia, mbenjamin, mburns, mhackett, mhulan, michal.skrivanek, nmoumoul, nstielau, obarenbo, orabin, pcreech, rchan, rjerrido, rpetrell, sclewis, sherold, simaishi, slinaber, smallamp, smcdonal, sokeeffe, sostapov, sponnaga, tkuratom, trathi, vereddy, yturgema
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1977960, 1977961, 1977962, 1978824
Bug Blocks:	1977971

Description Pedro Sampaio 2021-06-30 19:40:08 UTC

A flaw was found in ansible-runner. The default temporary files configuration in ansible-2.0.0 is written to world rw location. An attacker can pre-create that directory, which may allow them to either read potentially private information or force ansible-runner to write files as the legitimate user in a place they did not expect.

Upstream issue:

https://github.com/ansible/ansible-runner/issues/738

Upstream patch:

https://github.com/ansible/ansible-runner/pull/742/commits/60b059f00409224acae1e417153a241c8591ad89

Comment 1 Pedro Sampaio 2021-06-30 19:40:56 UTC

Created python-ansible-runner tracking bugs for this issue:

Affects: epel-7 [bug 1977962]
Affects: fedora-all [bug 1977961]
Affects: openstack-rdo [bug 1977960]

Comment 4 Sage McTaggart 2021-07-02 20:49:33 UTC

Red Hat Ceph Storage 4 ships an older version of ansible-runner which does not include the affected code, however, it does use a hardcoded path to the private data, with shipping a vulnerable os.path.join functionality, which could result in an attacker pre-creating the directory for the private data with world rw permissions as in this flaw. As a result, a low priority tracker has been filed.

Comment 7 Tapas Jena 2021-08-11 17:29:29 UTC

Analysis is complete for all the concerned Ansible components and it was found that AAP 1.2 and Ansible Tower are affected by this vulnerability. However, AAP 2.0 is "Not Affected" by this vulnerability as it ships ansible-runner 2.0.1 which already contains the fix for this issue.

Comment 10 Tapas Jena 2021-11-12 17:09:19 UTC

This vulnerability was part of ansible_runner_2.0 but was fixed before it got published it.  It was fixed by this PR https://github.com/ansible/ansible-runner/pull/742 (the commits in that PR got back-port to release_2.0 before we went GA)
This code wasn't part of 1.4 - so no released version of runner is actually impacted by this.

Finally, no any shipped ansible runner version from Red Hat has been facing the issue. Hence, though this was marked as "affected" initially, marking it back to "not affected" . However, since this is a valid vulnerability, the CVE will remain valid as well.