affected:
- package:
    ecosystem: PyPI
    name: ansible-runner
    purl: pkg:pypi/ansible-runner
  ranges:
  - events:
    - introduced: 2.0.0
    - fixed: 2.1.0
    type: ECOSYSTEM
  versions:
  - 2.0.0
  - 2.0.1
  - 2.0.2
  - 2.0.3
  - 2.0.4
  - 2.1.0.0a1
  - 2.1.0.0a2
  - 2.1.0.0b1
aliases:
- CVE-2021-3701
- GHSA-wwch-cmqr-hhrm
details: A flaw was found in ansible-runner where the default temporary files configuration
  in ansible-2.0.0 are written to world R/W locations. This flaw allows an attacker
  to pre-create the directory, resulting in reading private information or forcing
  ansible-runner to write files as the legitimate user in a place they did not expect.
  The highest threat from this vulnerability is to confidentiality and integrity.
id: PYSEC-2022-43067
modified: '2024-11-25T18:33:04.123836Z'
published: '2022-08-23T16:15:00Z'
references:
- type: ADVISORY
  url: https://access.redhat.com/security/cve/CVE-2021-3701
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=1977959
- type: FIX
  url: https://bugzilla.redhat.com/show_bug.cgi?id=1977959
- type: ADVISORY
  url: https://bugzilla.redhat.com/show_bug.cgi?id=1977959
- type: FIX
  url: https://github.com/ansible/ansible-runner/pull/742/commits
- type: WEB
  url: https://github.com/ansible/ansible-runner/pull/742/commits
- type: REPORT
  url: https://github.com/ansible/ansible-runner/issues/738
severity:
- score: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
  type: CVSS_V3