7.5
High
CVE-2020-1737 A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function…
Description
A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the win_unzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ansible | Versions not published |
References
- bugzilla.redhat.com bugzilla.redhat.com
- github.com github.com
- FEDORA-2020-a3f12bcff4 lists.fedoraproject.org
- FEDORA-2020-0cab7041f7 lists.fedoraproject.org
- FEDORA-2020-87f5e1e829 lists.fedoraproject.org
- GLSA-202006-11 security.gentoo.org
Timeline
- Published
- Last modified
Other CVEs of Ansible
The 29 CVEs of Ansible →
CVE-2020-14332
A flaw was found in the Ansible Engine when using module_args
5.5
Medium
CVE-2020-14330
An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data…
5.0
Medium
CVE-2020-10744
An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running…
5.0
Medium
CVE-2020-1746
A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and…
5.0
Medium