Lack of data validation - Path Traversal In ansible
Description
Ansible Path Traversal vulnerability Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 alpine v3.9 | =0.3.1-r0 || =0.4-r0 || =0.5-r0 || =0.7-r0 || =0.7.1-r0 || =0.8-r0 || =0.9-r0 || =1.0-r0 || =1.0-r1 || =1.1-r0 || =1.1-r1 || =1.2-r1 || =1.2.1-r1 || =1.2.2-r0 || =1.2.3-r0 || =1.3.3-r0 || =1.3.4-r0 || =1.4.1-r0 || =1.4.3-r0 || =1.4.5-r0 || =1.5.0-r0 || =1.5.4-r0 || =1.5.5-r0 || =1.6.1-r0 || =1.6.5-r0 || =1.6.6-r0 || =1.6.7-r0 || =1.7.0-r0 || =1.7.1-r0 || =1.7.2-r0 || =1.8.0-r0 || =1.8.2-r0 || =1.8.4-r0 || =1.9.2-r0 || =1.9.2-r1 || =1.9.3-r0 || =1.9.3-r1 || =1.9.4-r0 || =2.0.0.2-r0 || =2.0.0.2-r1 || =2.0.1.0-r1 || =2.1.0.0-r0 || =2.1.1.0-r0 || =2.1.2.0-r0 || =2.2.0.0-r0 || =2.2.1.0-r0 || =2.2.1.0-r1 || =2.2.2.0-r0 || =2.3.0.0-r0 || =2.3.0.0-r1 || =2.3.1.0-r0 || =2.3.2.0-r0 || =2.4.0.0-r0 || =2.4.1.0-r0 || =2.4.2.0-r0 || =2.4.3.0-r0 || =2.5.0-r0 || =2.5.2-r0 || =2.5.4-r0 || =2.5.5-r0 || =2.6.0-r0 || =2.6.1-r0 || =2.6.3-r0 || =2.7.0-r0 || =2.7.0-r1 || =2.7.12-r0 || =2.7.13-r0 || =2.7.14-r0 || =2.7.16-r0 || >=0 <2.7.17-r0 | 2.7.17-r0 | |
alpine v3.12 | =0.3.1-r0 || =0.4-r0 || =0.5-r0 || =0.7-r0 || =0.7.1-r0 || =0.8-r0 || =0.9-r0 || =1.0-r0 || =1.0-r1 || =1.1-r0 || =1.1-r1 || =1.2-r1 || =1.2.1-r1 || =1.2.2-r0 || =1.2.3-r0 || =1.3.3-r0 || =1.3.4-r0 || =1.4.1-r0 || =1.4.3-r0 || =1.4.5-r0 || =1.5.0-r0 || =1.5.4-r0 || =1.5.5-r0 || =1.6.1-r0 || =1.6.5-r0 || =1.6.6-r0 || =1.6.7-r0 || =1.7.0-r0 || =1.7.1-r0 || =1.7.2-r0 || =1.8.0-r0 || =1.8.2-r0 || =1.8.4-r0 || =1.9.2-r0 || =1.9.2-r1 || =1.9.3-r0 || =1.9.3-r1 || =1.9.4-r0 || =2.0.0.2-r0 || =2.0.0.2-r1 || =2.0.1.0-r1 || =2.1.0.0-r0 || =2.1.1.0-r0 || =2.1.2.0-r0 || =2.2.0.0-r0 || =2.2.1.0-r0 || =2.2.1.0-r1 || =2.2.2.0-r0 || =2.3.0.0-r0 || =2.3.0.0-r1 || =2.3.1.0-r0 || =2.3.2.0-r0 || =2.4.0.0-r0 || =2.4.1.0-r0 || =2.4.2.0-r0 || =2.4.3.0-r0 || =2.5.0-r0 || =2.5.2-r0 || =2.5.4-r0 || =2.5.5-r0 || =2.6.0-r0 || =2.6.1-r0 || =2.6.3-r0 || =2.7.0-r0 || =2.7.0-r1 || =2.7.9-r0 || =2.7.9-r1 || =2.8.0-r1 || =2.8.1-r0 || =2.8.2-r0 || =2.8.3-r0 || =2.8.4-r0 || =2.8.6-r0 || =2.8.6-r1 || =2.8.6-r2 || =2.8.6-r3 || =2.9.1-r0 || =2.9.2-r0 || =2.9.2-r1 || =2.9.3-r0 || =2.9.4-r0 || =2.9.5-r0 || =2.9.6-r0 || >=0 <2.9.7-r0 | 2.9.7-r0 | |
 debian 11 | >=0 <2.7.7+dfsg-1 | 2.7.7+dfsg-1 | |
alpine v3.14 | =0.3.1-r0 || =0.4-r0 || =0.5-r0 || =0.7-r0 || =0.7.1-r0 || =0.8-r0 || =0.9-r0 || =1.0-r0 || =1.0-r1 || =1.1-r0 || =1.1-r1 || =1.2-r1 || =1.2.1-r1 || =1.2.2-r0 || =1.2.3-r0 || =1.3.3-r0 || =1.3.4-r0 || =1.4.1-r0 || =1.4.3-r0 || =1.4.5-r0 || =1.5.0-r0 || =1.5.4-r0 || =1.5.5-r0 || =1.6.1-r0 || =1.6.5-r0 || =1.6.6-r0 || =1.6.7-r0 || =1.7.0-r0 || =1.7.1-r0 || =1.7.2-r0 || =1.8.0-r0 || =1.8.2-r0 || =1.8.4-r0 || =1.9.2-r0 || =1.9.2-r1 || =1.9.3-r0 || =1.9.3-r1 || =1.9.4-r0 || =2.0.0.2-r0 || =2.0.0.2-r1 || =2.0.1.0-r1 || =2.1.0.0-r0 || =2.1.1.0-r0 || =2.1.2.0-r0 || =2.2.0.0-r0 || =2.2.1.0-r0 || =2.2.1.0-r1 || =2.2.2.0-r0 || =2.3.0.0-r0 || =2.3.0.0-r1 || =2.3.1.0-r0 || =2.3.2.0-r0 || =2.4.0.0-r0 || =2.4.1.0-r0 || =2.4.2.0-r0 || =2.4.3.0-r0 || =2.5.0-r0 || =2.5.2-r0 || =2.5.4-r0 || =2.5.5-r0 || =2.6.0-r0 || =2.6.1-r0 || =2.6.3-r0 || =2.7.0-r0 || =2.7.0-r1 || =2.7.9-r0 || =2.7.9-r1 || =2.8.0-r1 || =2.8.1-r0 || =2.8.2-r0 || =2.8.3-r0 || =2.8.4-r0 || =2.8.6-r0 || =2.8.6-r1 || =2.8.6-r2 || =2.8.6-r3 || =2.9.1-r0 || =2.9.2-r0 || =2.9.2-r1 || =2.9.3-r0 || =2.9.4-r0 || =2.9.5-r0 || =2.9.6-r0 || >=0 <2.9.7-r0 | 2.9.7-r0 | |
debian 14 | >=0 <2.7.7+dfsg-1 | 2.7.7+dfsg-1 | |
alpine v3.11 | =0.3.1-r0 || =0.4-r0 || =0.5-r0 || =0.7-r0 || =0.7.1-r0 || =0.8-r0 || =0.9-r0 || =1.0-r0 || =1.0-r1 || =1.1-r0 || =1.1-r1 || =1.2-r1 || =1.2.1-r1 || =1.2.2-r0 || =1.2.3-r0 || =1.3.3-r0 || =1.3.4-r0 || =1.4.1-r0 || =1.4.3-r0 || =1.4.5-r0 || =1.5.0-r0 || =1.5.4-r0 || =1.5.5-r0 || =1.6.1-r0 || =1.6.5-r0 || =1.6.6-r0 || =1.6.7-r0 || =1.7.0-r0 || =1.7.1-r0 || =1.7.2-r0 || =1.8.0-r0 || =1.8.2-r0 || =1.8.4-r0 || =1.9.2-r0 || =1.9.2-r1 || =1.9.3-r0 || =1.9.3-r1 || =1.9.4-r0 || =2.0.0.2-r0 || =2.0.0.2-r1 || =2.0.1.0-r1 || =2.1.0.0-r0 || =2.1.1.0-r0 || =2.1.2.0-r0 || =2.2.0.0-r0 || =2.2.1.0-r0 || =2.2.1.0-r1 || =2.2.2.0-r0 || =2.3.0.0-r0 || =2.3.0.0-r1 || =2.3.1.0-r0 || =2.3.2.0-r0 || =2.4.0.0-r0 || =2.4.1.0-r0 || =2.4.2.0-r0 || =2.4.3.0-r0 || =2.5.0-r0 || =2.5.2-r0 || =2.5.4-r0 || =2.5.5-r0 || =2.6.0-r0 || =2.6.1-r0 || =2.6.3-r0 || =2.7.0-r0 || =2.7.0-r1 || =2.7.9-r0 || =2.7.9-r1 || =2.8.0-r1 || =2.8.1-r0 || =2.8.2-r0 || =2.8.3-r0 || =2.8.4-r0 || =2.8.6-r0 || =2.8.6-r1 || =2.8.6-r2 || =2.8.6-r3 || =2.9.1-r0 || =2.9.3-r0 || =2.9.6-r0 || >=0 <2.9.7-r0 | 2.9.7-r0 | |
debian 13 | >=0 <2.7.7+dfsg-1 | 2.7.7+dfsg-1 | |
alpine v3.13 | =0.3.1-r0 || =0.4-r0 || =0.5-r0 || =0.7-r0 || =0.7.1-r0 || =0.8-r0 || =0.9-r0 || =1.0-r0 || =1.0-r1 || =1.1-r0 || =1.1-r1 || =1.2-r1 || =1.2.1-r1 || =1.2.2-r0 || =1.2.3-r0 || =1.3.3-r0 || =1.3.4-r0 || =1.4.1-r0 || =1.4.3-r0 || =1.4.5-r0 || =1.5.0-r0 || =1.5.4-r0 || =1.5.5-r0 || =1.6.1-r0 || =1.6.5-r0 || =1.6.6-r0 || =1.6.7-r0 || =1.7.0-r0 || =1.7.1-r0 || =1.7.2-r0 || =1.8.0-r0 || =1.8.2-r0 || =1.8.4-r0 || =1.9.2-r0 || =1.9.2-r1 || =1.9.3-r0 || =1.9.3-r1 || =1.9.4-r0 || =2.0.0.2-r0 || =2.0.0.2-r1 || =2.0.1.0-r1 || =2.1.0.0-r0 || =2.1.1.0-r0 || =2.1.2.0-r0 || =2.2.0.0-r0 || =2.2.1.0-r0 || =2.2.1.0-r1 || =2.2.2.0-r0 || =2.3.0.0-r0 || =2.3.0.0-r1 || =2.3.1.0-r0 || =2.3.2.0-r0 || =2.4.0.0-r0 || =2.4.1.0-r0 || =2.4.2.0-r0 || =2.4.3.0-r0 || =2.5.0-r0 || =2.5.2-r0 || =2.5.4-r0 || =2.5.5-r0 || =2.6.0-r0 || =2.6.1-r0 || =2.6.3-r0 || =2.7.0-r0 || =2.7.0-r1 || =2.7.9-r0 || =2.7.9-r1 || =2.8.0-r1 || =2.8.1-r0 || =2.8.2-r0 || =2.8.3-r0 || =2.8.4-r0 || =2.8.6-r0 || =2.8.6-r1 || =2.8.6-r2 || =2.8.6-r3 || =2.9.1-r0 || =2.9.2-r0 || =2.9.2-r1 || =2.9.3-r0 || =2.9.4-r0 || =2.9.5-r0 || =2.9.6-r0 || >=0 <2.9.7-r0 | 2.9.7-r0 | |
 pypi | >=0 <2.5.15 || >=2.6.0a1 <2.6.14 || >=2.7.0a1 <2.7.8 | 2.5.15, 2.6.14, 2.7.8 | |
alpine v3.8 | =0.3.1-r0 || =0.4-r0 || =0.5-r0 || =0.7-r0 || =0.7.1-r0 || =0.8-r0 || =0.9-r0 || =1.0-r0 || =1.0-r1 || =1.1-r0 || =1.1-r1 || =1.2-r1 || =1.2.1-r1 || =1.2.2-r0 || =1.2.3-r0 || =1.3.3-r0 || =1.3.4-r0 || =1.4.1-r0 || =1.4.3-r0 || =1.4.5-r0 || =1.5.0-r0 || =1.5.4-r0 || =1.5.5-r0 || =1.6.1-r0 || =1.6.5-r0 || =1.6.6-r0 || =1.6.7-r0 || =1.7.0-r0 || =1.7.1-r0 || =1.7.2-r0 || =1.8.0-r0 || =1.8.2-r0 || =1.8.4-r0 || =1.9.2-r0 || =1.9.2-r1 || =1.9.3-r0 || =1.9.3-r1 || =1.9.4-r0 || =2.0.0.2-r0 || =2.0.0.2-r1 || =2.0.1.0-r1 || =2.1.0.0-r0 || =2.1.1.0-r0 || =2.1.2.0-r0 || =2.2.0.0-r0 || =2.2.1.0-r0 || =2.2.1.0-r1 || =2.2.2.0-r0 || =2.3.0.0-r0 || =2.3.0.0-r1 || =2.3.1.0-r0 || =2.3.2.0-r0 || =2.4.0.0-r0 || =2.4.1.0-r0 || =2.4.2.0-r0 || =2.4.3.0-r0 || =2.5.0-r0 || =2.5.2-r0 || =2.5.4-r0 || =2.5.5-r0 || >=0 <2.5.15-r0 | 2.5.15-r0 |
1-10 of 12
10
Aliases
References
1. https://github.com/ansible/ansible/pull/521332. https://github.com/ansible/ansible/commit/396a2f74717477d80600450e2b7e45349d7b51103. https://github.com/ansible/ansible/commit/4be3215d2f9f84ca283895879f0c6ce1ed7dd3334. https://github.com/ansible/ansible/commit/f3edc091523fbe301926b7a0db25fbbd96940d935. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-38286. https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2019-5.yaml7. https://usn.ubuntu.com/4072-18. http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html9. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html10. http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html11. http://packetstormsecurity.com/files/172837/Ansible-Fetch-Path-Traversal.html
Does your application use this vulnerable software?
During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.