lib/ansible/playbook/__init__.py
in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/
.
{ "nvd_published_at": "2013-09-16T19:14:00Z", "cwe_ids": [ "CWE-281" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2023-08-28T23:28:04Z" }