CVE-2020-10685: Ansible Engine Vulnerability
Summary
CVE-2020-10685: A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 whe... Affects ansible across 3 version ranges.
>= 2.7.0, < 2.7.17
>= 2.8.0, < 2.8.11
>= 2.9.0, < 2.9.7
Fixed in 2.7.17, 2.8.11 or 2.9.7, depending on the release line you run. How to fix ↓
Also tracked for
- ansible · Debian:11
The same CVE-2020-10685 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ansible Engine is an open-source automation platform that allows users to automate IT tasks such as configuration management, application deployment, and orchestration. It is widely used in the industry for its simplicity and flexibility. However, a vulnerability has been discovered in Ansible Engine versions 2.7.x, 2.8.x, and 2.9.x, as well as Ansible Tower versions 3.4.5, 3.5.5, and 3.6.3. This vulnerability affects modules that decrypt vault files, such as assemble, script, unarchive, win_copy, aws_s3, or copy modules. The flaw lies in the creation of a temporary directory in /tmp, which leaves sensitive data unencrypted. On certain operating systems, where /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot, leaving the decrypted data vulnerable even when the host is switched off.
Vulnerability Detail
The vulnerability allows an attacker with access to the host to retrieve sensitive data that should have been encrypted. This can lead to unauthorized access to confidential information, such as passwords, API keys, or other secrets stored in vault files. The issue arises due to the improper handling of temporary directories, leaving decrypted data exposed on the filesystem. It is important to note that the system remains vulnerable even when it is not running, as the decrypted data persists until the host is rebooted. Therefore, it is crucial to clear the decrypted data as soon as possible and ensure that it is properly encrypted.
How To Fix
Latest published version: 14.5.0 as of 22 Oct 2026
pip install --upgrade "ansible==14.5.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.7.0, < 2.7.172.7.17pip install --upgrade "ansible==2.7.17" -
>= 2.8.0, < 2.8.112.8.11pip install --upgrade "ansible==2.8.11" -
>= 2.9.0, < 2.9.72.9.7pip install --upgrade "ansible==2.9.7"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually clear the temporary directory in /tmp after using modules that decrypt vault files. This can be done by running the following command:
$ rm -rf /tmp/ansible_*
However, this workaround is not recommended as it requires manual intervention and may not be feasible in all scenarios. It is strongly advised to update to the fixed versions mentioned above.
Conclusion
In conclusion, a vulnerability has been discovered in Ansible Engine and Ansible Tower that allows unauthorized access to sensitive data. It is crucial to update to the fixed versions mentioned above and follow the recommended steps to ensure the security of your Ansible deployments. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ansible →
FAQ
Ansible Engine is an open-source automation platform used for configuration management, application deployment, and orchestration.
Ansible Engine versions 2.7.x, 2.8.x, and 2.9.x, as well as Ansible Tower versions 3.4.5, 3.5.5, and 3.6.3 are affected.
Modules that decrypt vault files, such as assemble, script, unarchive, win_copy, aws_s3, or copy modules, are affected.
The vulnerability allows an attacker with access to the host to retrieve sensitive data that should have been encrypted, potentially leading to unauthorized access to confidential information.
A temporary workaround is to manually clear the temporary directory in /tmp after using modules that decrypt vault files. However, it is strongly recommended to update to the fixed versions instead.
Related vulnerabilities
Recent vulnerabilities recorded for ansible.
