CVE-2021-3702 ansible-runner vulnerable to Race Condition

What is CVE-2021-3702?

CVE-2021-3702 is a medium-severity vulnerability in ansible-runner, published on 23 Aug 2022. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, substitute their directory at that name, and then have access to ansible-runner's private_data_dir the next time ansible-runner made use of the private_data_dir. The highest Threat out of this flaw is to integrity and confidentiality.

Weakness: CWE-362

Which versions are affected by CVE-2021-3702?

3 open source packages ship an affected version, including ansible-runner. It affects 1 product.

Products include Redhat Ansible Runner.

How do I fix CVE-2021-3702?

Upgrade ansible-runner to 2.1.0 or later.

Is CVE-2021-3702 being exploited?

There is no known exploitation of CVE-2021-3702 in the wild and no public exploit code.

Other vulnerabilities in ansible-runner

• CVE-2021-4041 ansible-runner vulnerable to shell command injection High 7.8
• CVE-2021-3701 ansible-runner has default temporary files written to world R/W locations Medium 6.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-772j-xvf9-qpf5, PYSEC-2022-43068.