GitStock

samdoran/ansible · Security

Path Traversal in Ansible

GHSA ID
GHSA-893h-35v4-mxqx
CVE ID
CVE-2020-1737
Severity
high
Published
Updated
CVSS
7.8 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v3
7.8 · CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4
8.5 · CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Description

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.

CWEs

  • CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

References