GHSA-3c67-gc48-983w

Path Traversal in Ansible

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-10691

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	ansible	>= 2.9.0a1, < 2.9.7	2.9.7

Details

As written in the advisory (Markdown source, shown as plain text).

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running `ansible-galaxy collection` install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-10691 advisory
https://github.com/ansible/ansible/pull/68596 web
https://github.com/ansible/ansible/commit/b2551bb6943eec078066aa3a923e0bb3ed85abe8 web
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10691 web
https://github.com/advisories/GHSA-3c67-gc48-983w advisory
https://github.com/ansible/ansible package
https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-2.yaml web