Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the local ansible controller host, by not restricting an absolute path.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-3828US | medium4.2 | — | ||
Ansible fetch module before versions 2.5.15, 2.6.14, 2.7.8 has a path traversal vulnerability which allows copying and overwriting files outside of the specified destination in the… | ||||
02
references
External citations — patches, advisories, analysis.
- http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00021.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00077.htmlWEB
- http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00020.htmlWEB
- https://access.redhat.com/errata/RHSA-2019:3744ADVISORY
- https://access.redhat.com/errata/RHSA-2019:3789ADVISORY
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3828REPORT
- https://github.com/advisories/GHSA-74vq-h4q8-x6jvADVISORY
- https://github.com/ansible/ansible/pull/52133WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan