PYSEC-2020-9: Path Traversal

Q: Which Ansible versions require remediation?

The issue affects Ansible 2.7.17 and earlier, 2.8.9 and earlier, and 2.9.6 and earlier. It is fixed in Ansible 2.10.

Q: What does an attacker need to exploit this issue?

An attacker needs to provide or cause use of a crafted ZIP archive with path-traversal entries during extraction through the win_unzip module's Extract-Zip function. The crafted archive can cause files to be extracted outside the intended destination folder.

Q: What is the likely impact of successful exploitation?

Successful exploitation can write extracted files to unintended locations in the file system. The reported severity vector indicates high confidentiality, integrity, and availability impact, with local access and low privileges required.

Published Mar 9, 2020

Updated

A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prior, and 2.9.6 and prior when using the Extract-Zip function from the winunzip module as the extracted file(s) are not checked if they belong to the destination folder. An attacker could take advantage of this flaw by crafting an archive anywhere in the file system, using a path traversal. This issue is fixed in 2.10.

Affected Software

1 affected component

Ansible Ansible<=2.7.17, <=2.8.9, <=2.9.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Ansible to a version that resolves this vulnerability.
Fixed in 2.10

Event History

Mar 9, 2020

CVE Published

via OSV·04:15 PM

Data Sourced

via OSV·04:15 PM

DescriptionSeverity

Frequently Asked Questions

Which Ansible versions require remediation?

The issue affects Ansible 2.7.17 and earlier, 2.8.9 and earlier, and 2.9.6 and earlier. It is fixed in Ansible 2.10.

What does an attacker need to exploit this issue?

An attacker needs to provide or cause use of a crafted ZIP archive with path-traversal entries during extraction through the win_unzip module's Extract-Zip function. The crafted archive can cause files to be extracted outside the intended destination folder.

What is the likely impact of successful exploitation?

Successful exploitation can write extracted files to unintended locations in the file system. The reported severity vector indicates high confidentiality, integrity, and availability impact, with local access and low privileges required.

PYSEC-2020-9: Path Traversal

Affected Software

Remediation

Event History

Frequently Asked Questions

Which Ansible versions require remediation?

What does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which Ansible versions require remediation?

What does an attacker need to exploit this issue?

What is the likely impact of successful exploitation?