logo

Database

Lack of data validation - Path Traversal In ansible

Description

Ansible Path Traversal vulnerability Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

1-10 of 11

10

Aliases

1. CVE-2019-38282. NVD-2019-38283. OSV-ALPINE-2019-38284. OSV-2019-38285. OSV-DEBIAN-2019-38286. GHSA-74vq-h4q8-x6jv7. GCVE-2019-38288. SECURITY-CVE-2019-38289. access.redhat.com10. access.redhat.com11. SECURITY-TRACKER-CVE-2019-3828

References

1. https://github.com/ansible/ansible/pull/521332. https://github.com/ansible/ansible/commit/396a2f74717477d80600450e2b7e45349d7b51103. https://github.com/ansible/ansible/commit/4be3215d2f9f84ca283895879f0c6ce1ed7dd3334. https://github.com/ansible/ansible/commit/f3edc091523fbe301926b7a0db25fbbd96940d935. https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-38286. https://github.com/pypa/advisory-database/tree/main/vulns/ansible/PYSEC-2019-5.yaml7. https://usn.ubuntu.com/4072-18. http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.html9. http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.html10. http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.html11. http://packetstormsecurity.com/files/172837/Ansible-Fetch-Path-Traversal.html

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.