6.3
Moyenne
CVE-2023-5189 A path traversal vulnerability exists in Ansible when extracting tarballs
Description
A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Ansible Automation Platform 2.4 for RHEL 8 | Versions non publiées | |
| Red Hat Ansible Automation Platform 2.4 for RHEL 9 | Versions non publiées | |
| Red Hat Satellite 6.14 for RHEL 8 | Versions non publiées | |
| Red Hat Satellite 6.15 for RHEL 8 | Versions non publiées |
Références
- RHSA-2023:7773 access.redhat.com
- RHSA-2024:1536 access.redhat.com
- RHSA-2024:2010 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2234387 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Ansible Automation Platform 2.4 for RHEL 8
Les 21 CVE de Red Hat Ansible Automation Platform 2.4 for RHEL 8 →
CVE-2026-84719
Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)
9.9
Critique
CVE-2026-75884
Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups
9.1
Critique
CVE-2026-84502
Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce on the controller-task control-plane pod
9.9
Critique
CVE-2026-84474
Automation-controller: automation-controller-container: automation-controller: view_jobtemplate to execute privilege escalation via host_config_key exposure and x-forwarded-for spoofing of provisioning-callback host match
9.9
Critique