CVE-2021-3533: Time-of-check Time-of-use (TOCTOU) Race Condition

June 9, 2021 (updated April 25, 2022)

A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory. When this occurs, there is a race condition on the managed machine. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async result data. This flaw affects Ansible Tower and Ansible Automation Platform

References

bugzilla.redhat.com/show_bug.cgi?id=1956477
nvd.nist.gov/vuln/detail/CVE-2021-3533

Code Behaviors & Features

Detect and mitigate CVE-2021-3533 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →