ALPINE-CVE-2020-1733
Record from OSV · Published March 11, 2020
A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with "umask 77 && mkdir -p <dir>"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| ansible | Alpine:v3.12 | 2.9.7-r0 |
| ansible | Alpine:v3.9 | 2.7.17-r0 |
| ansible-base | Alpine:v3.14 | 2.9.7-r0 |
| ansible | Alpine:v3.10 | 2.8.11-r0 |
| ansible | Alpine:v3.11 | 2.9.7-r0 |
| ansible-base | Alpine:v3.13 | 2.9.7-r0 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Alpine:v3.12 | ansible | 0.8-r0, 0.9-r0, 1.0-r0 |
| Alpine:v3.9 | ansible | 2.7.0-r1, 2.8.0, 1.2.3-r0 |
| Alpine:v3.14 | ansible-base | 2.8.3-r0, 2.8.6-r1, 2.8.6-r2 |
| Alpine:v3.10 | ansible | 1.9.2-r1, 1.5.0-r0, 0 |
| Alpine:v3.11 | ansible | 2.8.1-r0, 0.3.1-r0, 0.7-r0 |
| Alpine:v3.13 | ansible-base | 2.2.0.0-r0, 1.5.5-r0, 2.6.0-r0 |
Timeline
- Mar 11, 2020 CVE Published
- Aug 5, 2026 CVE Updated
- Aug 8, 2026 Distribution Patch
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln ALPINE-CVE-2020-1733
vulnetix vdb fixes ALPINE-CVE-2020-1733Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/ALPINE-CVE-2020-1733/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart