6.3
Medium
CVE-2023-5115 An absolute path traversal attack exists in the Ansible automation platform
Description
An absolute path traversal attack exists in the Ansible automation platform. This flaw allows an attacker to craft a malicious Ansible role and make the victim execute the role. A symlink can be used to overwrite a file outside of the extraction path.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2.3 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.3 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Versions not published | |
| Red Hat Ansible Automation Platform 1.2 | Versions not published |
References
- RHSA-2023:5701 access.redhat.com
- RHSA-2023:5758 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2233810 bugzilla.redhat.com
Timeline
- Published
- Last modified