6.3
Medium
CVE-2023-5189 A path traversal vulnerability exists in Ansible when extracting tarballs
Description
A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Versions not published | |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Versions not published | |
| Red Hat Satellite 6.14 for RHEL 8 | Versions not published | |
| Red Hat Satellite 6.15 for RHEL 8 | Versions not published |
References
- RHSA-2023:7773 access.redhat.com
- RHSA-2024:1536 access.redhat.com
- RHSA-2024:2010 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2234387 bugzilla.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Ansible Automation Platform 2.4 for RHEL 8
The 21 CVEs of Red Hat Ansible Automation Platform 2.4 for RHEL 8 →
CVE-2026-84719
Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
9.9
Critical
CVE-2026-75884
Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups
9.1
Critical
CVE-2026-84502
Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod
9.9
Critical
CVE-2026-84474
Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host match
9.9
Critical