CVE-2020-1740

Name	CVE-2020-1740
Description	A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes "ansible-vault edit", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2202-1, DSA-4950-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
ansible (PTS)	buster	2.7.7+dfsg-1+deb10u1	fixed
	buster (security)	2.7.7+dfsg-1+deb10u2	fixed
	bullseye	2.10.7+merged+base+2.10.8+dfsg-1	fixed
	bookworm	7.3.0+dfsg-1	fixed
	trixie	7.7.0+dfsg-3	fixed
	sid	9.4.0+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
ansible	source	jessie	1.7.2+dfsg-2+deb8u3		DLA-2202-1
ansible	source	stretch	(unfixed)	end-of-life
ansible	source	buster	2.7.7+dfsg-1+deb10u1		DSA-4950-1
ansible	source	(unstable)	2.9.7+dfsg-1

Notes

[stretch] - ansible <end-of-life> (EOL'd for stretch)
https://bugzilla.redhat.com/show_bug.cgi?id=1802193
https://github.com/ansible/ansible/issues/67798
https://github.com/ansible/ansible/pull/68644