REDHAT-BUG-2485379: High severity pypi/ansible-core vulnerability
A flaw was found in ansible-core's ansible-galaxy command. When installing a role, ansible-galaxy processes a meta/requirements.yml file that lists role dependencies. The src and name fields from this file are passed as arguments to git clone via Python's Popen without a -- separator to delimit options from positional arguments. A malicious role author can craft a dependency entry where the src field contains a git configuration flag (e.g., -ccore.sshCommand=sh -c "maliciouscommand") and the name field provides a valid repository URL. This results in arbitrary code execution on the system of any user who installs the role. The fix is to insert -- before the positional arguments in the git clone command list.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update ansible-galaxy so that when building the git clone command list, it inserts a literal "--" separator before the positional arguments (i.e., before the src and name-derived clone arguments) to prevent git option injection via dependency src/name fields.
ansible-galaxy (ansible-core) - git clone invocation insert -- before positional arguments = -- - Compensating control
Limit who can publish roles and restrict installation of roles from untrusted sources, since an attacker can craft meta/requirements.yml dependency entries to achieve arbitrary code execution during role installation.
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2485379?
The severity of REDHAT-BUG-2485379 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2485379?
To fix REDHAT-BUG-2485379, update the ansible-core package to the latest version that addresses this vulnerability.
What is the primary issue in REDHAT-BUG-2485379?
The primary issue in REDHAT-BUG-2485379 involves the ansible-galaxy command improperly processing role dependencies, which may lead to security vulnerabilities.
Which software is affected by REDHAT-BUG-2485379?
The software affected by REDHAT-BUG-2485379 is pypi/ansible-core.
When was REDHAT-BUG-2485379 published?
REDHAT-BUG-2485379 was published on June 5, 2026.