~ / search / GHSA-32p4-gm2c-wmch

GHSA-32p4-gm2c-wmch

ansible-core Incorrect Authorization vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-9902

Packages

EcosystemPackageAffectedFixed in
PyPI ansible-core < 2.14.18rc1 2.14.18rc1
PyPI ansible-core >= 2.15.0b1, < 2.15.13rc1 2.15.13rc1
PyPI ansible-core >= 2.16.0b1, < 2.16.13rc1 2.16.13rc1
PyPI ansible-core >= 2.17.0b1, < 2.17.6rc1 2.17.6rc1
PyPI ansible-core >= 2.18.0b1, < 2.18.0rc2 2.18.0rc2

Details

As written in the advisory (Markdown source, shown as plain text).

A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.

References

External links from the advisory. They lead to third-party sites.