Description
A flaw was found in ansible-core. The _extract_collection_from_git() function in ansible-core's concrete_artifact_manager.py constructs git clone commands without a '--' (end-of-options) separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path.
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
|
 debian 13 | | =2.19.0-1 || =2.19.0~beta6-1 || =2.19.0~rc2-1 || =2.19.1-0+deb13u1 || =2.19.1-1 || =2.19.11-0+deb13u1 || =2.19.2-1 || =2.19.3-1 || =2.19.3-2 || =2.19.4-0+deb13u1 || =2.19.4-1 || =2.20.1-1 || =2.20.3-1 || =2.21.0-1 || =2.21.1~rc1-1 || =2.21.1~rc1-2 || =2.21.2-1 | - |
debian 13 | | | 5.4.0-1 |
debian 14 | | =2.19.0-1 || =2.19.0~beta6-1 || =2.19.0~rc2-1 || =2.19.1-1 || =2.19.2-1 || =2.19.3-1 || =2.19.3-2 || =2.19.4-1 || =2.20.1-1 || =2.20.3-1 || =2.21.0-1 || =2.21.1~rc1-1 || =2.21.1~rc1-2 || =2.21.2-1 | - |
debian 12 | | =2.14.10-1 || =2.14.11-1 || =2.14.11-2 || =2.14.13-1 || =2.14.16-0+deb12u1 || =2.14.18-0+deb12u1 || =2.14.18-0+deb12u2 || =2.14.3-1 || =2.14.6-1 || =2.14.7-1 || =2.14.8-1 || =2.14.9-1 || =2.14.9-2 || =2.16.5-1 || =2.16.6-1 || =2.17.0-1 || =2.17.1-1 || =2.17.2-1 || =2.17.3-1 || =2.17.5-1 || =2.17.5-2 || =2.17.5-3 || =2.17.5-4 || =2.17.5-5 || =2.18.0-1 || =2.18.0-2 || =2.18.1-1 || =2.18.1-2 || =2.18.1-3 || =2.18.1-4 || =2.18.3-1 || =2.19.0-1 || =2.19.0~beta1-1 || =2.19.0~beta1-2 || =2.19.0~beta2-1 || =2.19.0~beta4-1 || =2.19.0~beta5-1 || =2.19.0~beta6-1 || =2.19.0~rc2-1 || =2.19.1-1 || =2.19.2-1 || =2.19.3-1 || =2.19.3-2 || =2.19.4-1 || =2.19~pre20250506~462affa7c4-1 || =2.19~pre20250510~5347d4d4fc-1 || =2.20.1-1 || =2.20.3-1 || =2.21.0-1 || =2.21.1~rc1-1 || =2.21.1~rc1-2 || =2.21.2-1 | - |
 rpm rhel9 | | - | - |
rpm rhel10 | | - | - |
rpm rhel8 | | - | - |
debian 12 | | | 5.4.0-1 |
debian 14 | | | 5.4.0-1 |
