GHSA-893h-35v4-mxqx
Path Traversal in Ansible
At a glance
- Published
- Updated
- CVE
- CVE-2020-1737
- Aliases
- PYSEC-2020-9
- CVSS_V3
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS_V4
- CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
Affected packages
| Package | Versions |
|---|---|
| PyPI · ansible | introduced 2.8.0a1, fixed 2.8.9 |
| PyPI · ansible | introduced 2.9.0a1, fixed 2.9.6 |
| PyPI · ansible | introduced 0, fixed 2.7.17 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-1737 ADVISORY
- https://github.com/ansible/ansible/issues/67795 WEB
- https://github.com/ansible/ansible/pull/67799 WEB
- https://github.com/samdoran/ansible/commit/1de638b4d38d6d916588e2ad48d01f90dab8c36d WEB
- https://github.com/samdoran/ansible/commit/aaf549d7870b8687209a3282841b59207735b676 WEB
- https://github.com/samdoran/ansible/commit/b60aa26e2313a8d52c0e0d3fd01696e797605b72 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737 WEB
- https://github.com/advisories/GHSA-893h-35v4-mxqx ADVISORY
- https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2020-9.yaml WEB
- https://github.com/samdoran/ansible PACKAGE
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2 WEB
- https://security.gentoo.org/glsa/202006-11 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |