CVE-2020-10744: 
Ansible Tower vulnerability analysis and mitigation

An incomplete fix was discovered for the vulnerability CVE-2020-1733 in Ansible, specifically related to insecure temporary directory handling when running become_user from become directive. The original fix was insufficient to prevent race conditions on systems using ACLs and FUSE filesystems. This vulnerability affects Ansible Engine versions 2.7.18, 2.8.12, and 2.9.9 and earlier, as well as Ansible Tower versions 3.4.5, 3.5.6, and 3.6.4 and earlier (NVD, Ubuntu).

The vulnerability stems from an incomplete fix for CVE-2020-1733, where the 'mkdir -p' command used in the temporary directory creation process remains insecure by design. The vulnerability has a CVSS 3.1 Base Score of 5.0 (Medium) with the vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L. The issue is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization) and CWE-377 (Insecure Temporary File) (NVD).

The vulnerability could allow a local attacker to potentially cause a race condition, escalate privileges, and execute arbitrary code on systems using ACLs and FUSE filesystems (Ubuntu Security Notice).

The vulnerability requires local access with low privileges and user interaction. The attack complexity is considered high, and the scope is changed, indicating that the vulnerability can affect resources beyond its security scope (NVD).

The vulnerability has been fixed in Ansible Engine versions 2.7.19, 2.8.13, and 2.9.10. For Ansible Tower, updates were provided for affected versions. The fix was implemented through commit 77d0effcc5b2da1ef23e4ba32986a9759c27c10d in the upstream repository (Red Hat Bugzilla).

The vulnerability was discovered and reported by security researchers Damien Aumaitre and Nicolas Surbayrole from Quarkslab. Red Hat has classified this as a medium severity issue, and various Linux distributions including Ubuntu have provided security updates to address the vulnerability (Red Hat Bugzilla).