CVE-2020-10685: Exposure of Resource to Wrong Sphere

May 11, 2020 (updated December 21, 2021)

A flaw was found in Ansible when using modules which decrypts vault files. The temporary directory is created in /tmp and left unecrypted.

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10685
nvd.nist.gov/vuln/detail/CVE-2020-10685

Code Behaviors & Features

Detect and mitigate CVE-2020-10685 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →