CVE-2020-25636: 
Ansible vulnerability analysis and mitigation

A flaw was found in Ansible Base when using the aws_ssm connection plugin as there is no namespace separation for file transfers. Files are written directly to the root bucket, making it possible to have collisions when running multiple ansible processes. This vulnerability was discovered in September 2020 and affects Ansible Base version 2.10.1rc2 and earlier versions (Redhat Bugzilla, NVD).

The vulnerability stems from the aws_ssm connection plugin's file transfer implementation. When transferring files to instances, the plugin writes these files directly to the root of the S3 bucket without any namespace separation or instance-specific folders. This design flaw could lead to file collisions when multiple Ansible processes are running simultaneously and sharing the same bucket. The vulnerability has been assigned a CVSS v3.1 Base Score of 7.1 (HIGH) with the vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H (NVD).

The primary impact of this vulnerability affects service availability. When multiple Ansible processes attempt to transfer files simultaneously using the same S3 bucket, file collisions can occur, potentially leading to file corruption or overwriting of data. This could disrupt automated deployments and configuration management tasks (NVD).

The vulnerability requires local access and low privileges to exploit. While the attack complexity is low, it requires no user interaction to execute. The scope is unchanged, meaning the impact is limited to the security scope of the affected component (NVD).

The issue was fixed in aws_ssm version 1.3.0. Prior to the fix, Red Hat Product Security noted that mitigation options were either not available or did not meet their criteria for ease of use, deployment, applicability to widespread installation base, or stability (Redhat Bugzilla).