cveboard RSS feed

CVE-2020-10685

CVE.org · Published

Historical CVEsJSONAI instructions

Record status
Published
Identifier year (not publication year)
2020
Source publication
Source updated
Imported by cveboard
Source snapshot
cve_2026-10-24_midnight_baseline ·

Plain text

CNA source text (English)

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

Ansible

Vendor
Red Hat
Product
Ansible
Platforms
Unknown
Default status
Unknown
Ansible · Scoped product and version facts
Version (version)Status (status)Version scheme (versionType)Exclusive end (lessThan)Inclusive end (lessThanOrEqual)Status changes (at → status)
ansible-engine versions 2.7.x before 2.7.17affectedUnavailableUnavailableUnavailableNone listed
ansible-engine 2.8.x before 2.8.11affectedUnavailableUnavailableUnavailableNone listed
ansible-engine 2.9.x before 2.9.7affectedUnavailableUnavailableUnavailableNone listed
Ansible Tower <= 3.4.5affectedUnavailableUnavailableUnavailableNone listed
Ansible Tower <= 3.5.5affectedUnavailableUnavailableUnavailableNone listed
Ansible Tower <= 3.6.3affectedUnavailableUnavailableUnavailableNone listed