CVE-2020-25636CWE-377CWE-552

A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers

Medium · published October 5, 2020

CVSS v3.1
6.6
EPSS
0%
Percentile
22.5
In the wild
Unconfirmed
What it is

A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service availability.

The record
Technical detail
CVSS v3.1
6.6 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00309 · 22.5th percentile
Weaknesses
CWE-377 · Insecure Temporary File; CWE-552 · Files or Directories Accessible to External Parties
Published
2020-10-05T12:51Z
EPSS history
Timeline
  • 05 OCT 12:51Z
    A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers
    cvelistv5