~ / search / GHSA-55g2-vm3q-7w52

GHSA-55g2-vm3q-7w52

Ansible galaxy-importer Path Traversal vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-5189

Packages

EcosystemPackageAffectedFixed in
PyPI galaxy-importer <= 0.4.16 no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.

References

External links from the advisory. They lead to third-party sites.