CVE-2020-10691

2020-04-3016:23:36

CWE-22

redhat

www.cve.org

5.2 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.9%

JSON

An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install. When extracting a collection .tar.gz file, the directory is created without sanitizing the filename. An attacker could take advantage to overwrite any file within the system.

CNA Affected

[
  {
    "product": "Ansible",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "all ansible-engine versions 2.9.x prior to 2.9.7"
      }
    ]
  }
]