Filtered by vendor Redhat Subscriptions
Filtered by product Cloudforms Management Engine Subscriptions
Total 42 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2020-1733 3 Debian, Fedoraproject, Redhat 7 Debian Linux, Fedora, Ansible and 4 more 2024-08-04 5 Medium
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.
CVE-2020-1735 3 Debian, Fedoraproject, Redhat 7 Debian Linux, Fedora, Ansible and 4 more 2024-08-04 4.2 Medium
A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.