CVE-2020-10685 : What You Need to Know

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypt vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.

Understanding CVE-2020-10685

This CVE identifies a vulnerability in Ansible Engine and Ansible Tower related to the decryption of vault files, potentially leaving sensitive data unencrypted.

What is CVE-2020-10685?

The vulnerability in CVE-2020-10685 affects specific versions of Ansible Engine and Ansible Tower when using certain modules that decrypt vault files. It results in leaving decrypted data unencrypted in a temporary directory, posing a security risk.

The Impact of CVE-2020-10685

The vulnerability can lead to the exposure of sensitive data due to the improper handling of decrypted files, potentially compromising confidentiality.

Technical Details of CVE-2020-10685

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The flaw in Ansible Engine and Ansible Tower versions allows decrypted data to remain unencrypted in a temporary directory, exposing it to unauthorized access.

Affected Systems and Versions

Vendor: Red Hat
Affected Product: Ansible
Vulnerable Versions:
Ansible Engine versions 2.7.x before 2.7.17
Ansible Engine 2.8.x before 2.8.11
Ansible Engine 2.9.x before 2.9.7
Ansible Tower <= 3.4.5
Ansible Tower <= 3.5.5
Ansible Tower <= 3.6.3

Exploitation Mechanism

The vulnerability occurs when using modules that decrypt vault files, creating a temporary directory in /tmp that leaves decrypted data unencrypted, especially on systems where /tmp is not a tmpfs but part of the root partition.

Mitigation and Prevention

Protect your systems from CVE-2020-10685 with these mitigation strategies.

Immediate Steps to Take

Update Ansible Engine and Ansible Tower to the patched versions.
Clear decrypted data as soon as possible to prevent exposure.

Long-Term Security Practices

Regularly monitor and audit temporary directories for sensitive data.
Implement encryption best practices to safeguard data at rest and in transit.

Patching and Updates

Apply the latest security patches provided by Red Hat for Ansible Engine and Ansible Tower to address the vulnerability.