CVE-2020-10685: 
Ansible Tower vulnerability analysis and mitigation

A flaw was discovered in Ansible Engine affecting versions 2.7.x before 2.7.17, 2.8.x before 2.8.11, and 2.9.x before 2.9.7, as well as Ansible Tower before and including versions 3.4.5, 3.5.5, and 3.6.3. The vulnerability occurs when using modules that decrypt vault files such as assemble, script, unarchive, win_copy, aws_s3, or copy modules (NVD, Red Hat Bugzilla).

The vulnerability stems from improper cleanup of temporary files containing decrypted vault content. When modules decrypt vault files, they create temporary files in the /tmp directory, leaving the decrypted content unprotected. On operating systems where /tmp is part of the root partition rather than tmpfs, the decrypted data remains on disk until the system reboots (Red Hat Bugzilla). The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium) with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (NVD).

The primary impact of this vulnerability is the potential exposure of sensitive data. When the system is not running, decrypted vault content remains accessible on disk, potentially exposing confidential information that was intended to be encrypted. This is particularly concerning for systems where /tmp is not cleared between reboots (Red Hat Bugzilla).

The vulnerability requires local access to the system and can be exploited by examining the contents of the /tmp directory after Ansible operations involving vault-encrypted files. The risk is particularly relevant when the system is powered off, as the decrypted content remains on disk (Red Hat Bugzilla).

The issue has been fixed in Ansible Engine versions 2.7.17, 2.8.11, and 2.9.7. The fix involves using local temp directories instead of system temp and ensuring proper cleanup of dataloader temp files. Prior to patching, the only mitigation is to manually remove temporary files after every Ansible run (GitHub PR, Red Hat Advisory).