REDHAT-BUG-2234387
First published: Thu Aug 24 2023(Updated: )
A vulnerability was found in the galaxy importer of Ansible Automation Hub. The tarball extraction code is open to abuse in several ways (relative paths in the middle of a path, as well as symlinks that target arbitrary paths). If used to extract user-provided tarballs, this flaw could lead to arbitrary file overwrite.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Ansible Automation Hub |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/ansible/galaxy-importer/blob/2c5c7c05fdfb0835878234b36de32902c703616d/galaxy_importer/collection.py#L160-L165
- https://access.redhat.com/errata/RHSA-2023:7773
- https://access.redhat.com/errata/RHSA-2024:1536
- https://access.redhat.com/errata/RHSA-2024:2010
- https://bugzilla.redhat.com/show_bug.cgi?id=2234387
Frequently Asked Questions
What is the severity of REDHAT-BUG-2234387?
REDHAT-BUG-2234387 is classified as a critical vulnerability due to its potential for arbitrary file extraction.
How do I fix REDHAT-BUG-2234387?
To fix REDHAT-BUG-2234387, upgrade to the latest patched version of Red Hat Ansible Automation Hub.
What causes the vulnerability REDHAT-BUG-2234387?
The vulnerability REDHAT-BUG-2234387 is caused by improper handling of tarball extraction, allowing for exploitation through relative paths and symlinks.
Who is affected by REDHAT-BUG-2234387?
Anyone using Red Hat Ansible Automation Hub with the vulnerable tarball extraction feature is affected by REDHAT-BUG-2234387.
What impact does REDHAT-BUG-2234387 have on systems?
The impact of REDHAT-BUG-2234387 can lead to unauthorized access and potential system compromise due to arbitrary file extraction.
- agent/type
- agent/first-publish-date
- agent/severity
- agent/description
- agent/event
- agent/references
- agent/source
- agent/softwarecombine
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-5189
- agent/last-modified-date
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat ansible automation hub