CVE-2020-10685

A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as well as Ansible Tower before and including versions 3.4.5 and 3.5.5 and 3.6.3 when using modules which decrypts vault files such as assemble, script, unarchive, win_copy, aws_s3 or copy modules. The temporary directory is created in /tmp leaves the s ts unencrypted. On Operating Systems which /tmp is not a tmpfs but part of the root partition, the directory is only cleared on boot and the decryp emains when the host is switched off. The system will be vulnerable when the system is not running. So decrypted data must be cleared as soon as possible and the data which normally is encrypted ble.

• CWE-459
• CWE-459

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10685Issue Tracking, Patch, Vendor Advisory
• https://github.com/ansible/ansible/pull/68433Patch, Third Party Advisory
• https://security.gentoo.org/glsa/202006-11Third Party Advisory
• https://www.debian.org/security/2021/dsa-4950Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10685Issue Tracking, Patch, Vendor Advisory
• https://github.com/ansible/ansible/pull/68433Patch, Third Party Advisory
• https://security.gentoo.org/glsa/202006-11Third Party Advisory
• https://www.debian.org/security/2021/dsa-4950Third Party Advisory

Published

May 11, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-10678In Octopus Deploy before 2020.1.5, for customers running on-…8.8
• CVE-2020-1068An elevation of privilege vulnerability exists in Windows Me…7.8
• CVE-2020-10681The Filemanager in CMS Made Simple 2.2.13 has stored XSS via…5.4
• CVE-2020-10682The Filemanager in CMS Made Simple 2.2.13 allows remote code…7.8
• CVE-2020-10683dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DT…9.8
• CVE-2020-10684A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.…7.1
• CVE-2020-10686A flaw was found in Keycloak version 8.0.2 and 9.0.0, and wa…4.7
• CVE-2020-10687A flaw was discovered in all versions of Undertow before Und…4.8
• CVE-2020-10688A cross-site scripting (XSS) flaw was found in RESTEasy in v…6.1
• CVE-2020-10689A flaw was found in the Eclipse Che up to version 7.8.x, whe…6.8
• CVE-2020-1069A remote code execution vulnerability exists in Microsoft Sh…8.8
• CVE-2020-10690There is a use-after-free in kernel versions before 5.5 due …6.4