Bug 1977959 (CVE-2021-3701) - CVE-2021-3701 ansible-runner: Artifacts are written to world rw location by default
Summary: CVE-2021-3701 ansible-runner: Artifacts are written to world rw location by d...
Keywords:
Status: NEW
Alias: CVE-2021-3701
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 1977960 1977961 1977962 1978824
Blocks: 1977971
TreeView+ depends on / blocked
 
Reported: 2021-06-30 19:40 UTC by Pedro Sampaio
Modified: 2023-07-07 08:32 UTC (History)
60 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker to pre-create the directory, resulting in reading private information or forcing ansible-runner to write files as the legitimate user in a place they did not expect. The highest threat from this vulnerability is to confidentiality and integrity.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2021-06-30 19:40:08 UTC 
A flaw was found in ansible-runner. The default temporary files configuration in ansible-2.0.0 is written to world rw location. An attacker can pre-create that directory, which may allow them to either read potentially private information or force ansible-runner to write files as the legitimate user in a place they did not expect.

Upstream issue:

https://github.com/ansible/ansible-runner/issues/738

Upstream patch:

https://github.com/ansible/ansible-runner/pull/742/commits/60b059f00409224acae1e417153a241c8591ad89
Comment 1 Pedro Sampaio 2021-06-30 19:40:56 UTC 
Created python-ansible-runner tracking bugs for this issue:

Affects: epel-7 [bug 1977962]
Affects: fedora-all [bug 1977961]
Affects: openstack-rdo [bug 1977960]
Comment 4 Sage McTaggart 2021-07-02 20:49:33 UTC 
Red Hat Ceph Storage 4 ships an older version of ansible-runner which does not include the affected code, however, it does use a hardcoded path to the private data, with shipping a vulnerable os.path.join functionality, which could result in an attacker pre-creating the directory for the private data with world rw permissions as in this flaw. As a result, a low priority tracker has been filed.
Comment 7 Tapas Jena 2021-08-11 17:29:29 UTC 
Analysis is complete for all the concerned Ansible components and it was found that AAP 1.2 and Ansible Tower are affected by this vulnerability. However, AAP 2.0 is "Not Affected" by this vulnerability as it ships ansible-runner 2.0.1 which already contains the fix for this issue.
Comment 10 Tapas Jena 2021-11-12 17:09:19 UTC 
This vulnerability was part of ansible_runner_2.0 but was fixed before it got published it.  It was fixed by this PR https://github.com/ansible/ansible-runner/pull/742 (the commits in that PR got back-port to release_2.0 before we went GA)
This code wasn't part of 1.4 - so no released version of runner is actually impacted by this.

Finally, no any shipped ansible runner version from Red Hat has been facing the issue. Hence, though this was marked as "affected" initially, marking it back to "not affected" . However, since this is a valid vulnerability, the CVE will remain valid as well.
Note You need to log in before you can comment on or make changes to this bug.