CVE-2020-25636

Published: Oct 5, 2020Modified: Jun 17, 2026

7.1

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Exploitability: 1.8 / Impact: 5.2

Source: NVD

Description

A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service availability.

Affected (1)

Products: Redhat: Ansible

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Ansible	Version 2.10.1 rc2

Related CWEs

Insecure Temporary File

Creating and using insecure temporary files can leave application and system data vulnerable to attack.

Files or Directories Accessible to External Parties

The product makes files or directories accessible to unauthorized actors, even though they should not be.

References (4)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25636

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://github.com/ansible-collections/community.aws/issues/221

Source: secalert@redhat.com

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25636

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

https://github.com/ansible-collections/community.aws/issues/221

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.