GHSA-32p4-gm2c-wmch
ansible-core Incorrect Authorization vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2024-9902
- Aliases
- PYSEC-2026-1121
- CVSS_V3
- CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L
- CVSS_V4
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Description
A flaw was found in Ansible. The ansible-core `user` module can allow an unprivileged user to silently create or replace the contents of any file on any system path and take ownership of it when a privileged user executes the `user` module against the unprivileged user's home directory. If the unprivileged user has traversal permissions on the directory containing the exploited target file, they retain full control over the contents of the file as its owner.
Affected packages
| Package | Versions |
|---|---|
| PyPI · ansible-core | introduced 0, fixed 2.14.18rc1 |
| PyPI · ansible-core | introduced 2.15.0b1, fixed 2.15.13rc1 |
| PyPI · ansible-core | introduced 2.16.0b1, fixed 2.16.13rc1 |
| PyPI · ansible-core | introduced 2.17.0b1, fixed 2.17.6rc1 |
| PyPI · ansible-core | introduced 2.18.0b1, fixed 2.18.0rc2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-9902 ADVISORY
- https://github.com/ansible/ansible/commit/03794735d370db98a5ec2ad514fab2b0dd22d6be WEB
- https://github.com/ansible/ansible/commit/03daf774d0d80fb7235910ed1c2b4fbcaebdfe65 WEB
- https://github.com/ansible/ansible/commit/3b6de811abea0a811e03e3029222a7e459922892 WEB
- https://github.com/ansible/ansible/commit/9d7312f695639e804d2caeb1d0f51c716a9ac7dd WEB
- https://github.com/ansible/ansible/commit/f7be90626da3035c697623dcf9c90b7a0bc91c92 WEB
- https://access.redhat.com/errata/RHSA-2024:10762 WEB
- https://access.redhat.com/errata/RHSA-2024:8969 WEB
- https://access.redhat.com/errata/RHSA-2024:9894 WEB
- https://access.redhat.com/errata/RHSA-2025:1861 WEB
- https://access.redhat.com/security/cve/CVE-2024-9902 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2318271 WEB
- https://github.com/ansible/ansible PACKAGE
- https://lists.debian.org/debian-lts-announce/2024/11/msg00021.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |