~ / search / GHSA-74vq-h4q8-x6jv

GHSA-74vq-h4q8-x6jv

Ansible Path Traversal vulnerability

Source: GitHub Advisory Database (reviewed) Low CVE-2019-3828

Packages

EcosystemPackageAffectedFixed in
PyPI ansible < 2.5.15 2.5.15
PyPI ansible >= 2.6.0a1, < 2.6.14 2.6.14
PyPI ansible >= 2.7.0a1, < 2.7.8 2.7.8

Details

As written in the advisory (Markdown source, shown as plain text).

Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

References

External links from the advisory. They lead to third-party sites.