CVE-2020-10744: Insecure Temporary File in Ansible
Summary
CVE-2020-10744: Exposure of Resource to Wrong Sphere and Insecure Temporary File in Ansible. Affects ansible across 2 version ranges.
< 2.9.12
>= 2.10.0a1, < 2.10.0rc1
Fixed in 2.9.12 or 2.10.0rc1, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2020-10744 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible is an open-source automation tool that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the industry due to its simplicity and flexibility. However, Ansible is vulnerable to an insecure temporary file issue, which can lead to unauthorized access and potential data leakage.
Vulnerability Detail
The vulnerability, identified as CVE-2020-10744, stems from an incomplete fix for a previous flaw (CVE-2020-1733) related to Ansible's insecure temporary directory when running the 'become_user' command from the 'become' directive. The provided fix is insufficient to prevent a race condition on systems using ACLs and FUSE filesystems. This vulnerability affects Ansible Engine versions 2.7.18, 2.8.12, and 2.9.9, as well as previous versions. Additionally, Ansible Tower versions 3.4.5, 3.5.6, and 3.6.4, along with previous versions, are also affected.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 2.9.122.9.12pip install --upgrade "ansible==2.9.12" -
>= 2.10.0a1, < 2.10.0rc12.10.0rc1pip install --upgrade "ansible==2.10.0rc1"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually set the permissions of the temporary directory used by Ansible to restrict access. This can be achieved by modifying the ACLs or permissions of the directory to ensure that only authorized users have read and write access. However, this workaround may not provide complete protection and should be considered a temporary solution until the software is updated.
Conclusion
In conclusion, the CVE-2020-10744 vulnerability in Ansible exposes a resource to the wrong sphere and includes an insecure temporary file issue. It is crucial to update Ansible to the recommended versions to mitigate the risk of unauthorized access and potential data leakage. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible is an open-source automation tool used for configuration management, application deployment, and orchestration.
This vulnerability can lead to unauthorized access and potential data leakage due to the insecure handling of temporary files in Ansible.
Ansible Engine versions 2.7.18, 2.8.12, and 2.9.9, as well as previous versions, are affected. Ansible Tower versions 3.4.5, 3.5.6, and 3.6.4, along with previous versions, are also affected.
To fix this vulnerability, update Ansible to version 2.9.10 or later for Ansible Engine, or version 3.7.0 or later for Ansible Tower.
Yes, users can manually set the permissions of the temporary directory used by Ansible to restrict access. However, this should be considered a temporary solution until the software is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
