CVE-2021-3533: Time-of-check Time-of-use (TOCTOU) Race Condition
(updated )
A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory. When this occurs, there is a race condition on the managed machine. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async result data. This flaw affects Ansible Tower and Ansible Automation Platform
References
Code Behaviors & Features
Detect and mitigate CVE-2021-3533 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →