The atomic_move primitive is lacking moving files with a mode. This sets the destination files world-readable if the destination file does not exist and if the file exists could become with less restricted permissions before the move. This could lead in disclosing sensitive data.
Acknowledgments: Name: Damien Aumaitre (Quarkslab), Nicolas Surbayrole (Quarkslab)
Any upstream reference for the issue available?
Created ansible tracking bugs for this issue: Affects: epel-all [bug 1805332] Affects: fedora-all [bug 1805331]
Hey Salvatore, I am working to provide additional information regarding this issue; more details as you requested, affected versions as well as upstream links in case we already have. Prioritising this for now, I will get back to you asap. In reply to comment #4: > Any upstream reference for the issue available?
Red Hat CloudForms Management Engine 5.9 is in maintenance phase and we're no longer fixing "Low" severity CVEs.
Upstream fix: https://github.com/ansible/ansible/issues/67794
Created ansible tracking bugs for this issue: Affects: openstack-rdo [bug 1807876]
Red Hat Gluster Storage and Red Hat Ceph Storage no longer maintains its own version of Ansible. The fix will be provided from core Ansible. But we still ship ansible separately for ceph ubuntu.
CloudForms 5.11 do not use ansible-tower and 5.10 only using ansible-tower-venv-ansible atm. Closing this tracker.
Mitigation: This issue can be mitigated by specifying the "mode" on the task. That just leaves a race condition in place where newly created files that specify a mode in the task briefly go from 666 - umask to the final mode. An alternative workaround if many new files are created and to avoid setting a specific mode for each file would be to set the "mode" to "preserve" value. That will maintain the permissions of the source file on the controller in the final file on the managed host.
Statement: Ansible Engine 2.8.14 and 2.9.12 as well as previous versions and all 2.7.x versions are affected. Ansible Tower 3.6.5 and 3.7.2 as well as previous versions are affected. In Red Hat OpenStack Platform, because the flaw has a lower impact, ansible is not directly customer exposed, and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP ansible package.
Attempts were made to address this but ultimately removed as they caused more problems than they solved. Closing, as the products in question are no longer applying fixes for low severity CVEs.