CVE-2020-25636 Race condition in Community Collections

What is CVE-2020-25636?

CVE-2020-25636 is a medium-severity vulnerability in AWS Community Community Collections, published on 5 Oct 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making possible to have collisions when running multiple ansible processes. This issue affects mainly the service availability.

Weakness: CWE-552, CWE-377

Which versions are affected by CVE-2020-25636?

It affects 1 product.

Products include Redhat Ansible.

How do I fix CVE-2020-25636?

No fix has been published for CVE-2020-25636 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-25636 being exploited?

There is no known exploitation of CVE-2020-25636 in the wild and no public exploit code.

Other vulnerabilities in AWS Community Community Collections

• CVE-2014-4657 Ansible Remote Code Execution Critical 9.8
• CVE-2014-4966 Ansible Arbitrary Code Execution Critical 9.8
• CVE-2014-4967 Ansible Arbitrary Code Execution Critical 9.8
• CVE-2017-7550 Ansible Insertion of Sensitive Information into Log File vulnerability Critical 9.8
• CVE-2014-3498 Ansible Arbitrary Code Execution High 8.8

Sources

• CVE record
• NVD
• OSV
• How this page is made

Also known as UBUNTU-CVE-2020-25636.