Lucene search

Veracode Vulnerability DatabaseVERACODE:22590

HistoryFeb 28, 2020 - 4:29 a.m.

Path Traversal

2020-02-2804:29:40

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

14.2%

JSON

ansible is vulnerable to path traversal. The vulnerability exists as it does not properly normalize the file path to ensure that the file in the archive does not escape the extraction path.

CPENameOperatorVersion
ansiblele2.7.16
ansiblele2.8.10
ansiblele2.9.6
ansible:3.10eq2.8.8-r0
ansible:3.11eq2.9.3-r0
ansibleeq2.7.16-r0

Name	Operator	Version
ansible	le	2.7.16
ansible	le	2.8.10
ansible	le	2.9.6
ansible:3.10	eq	2.8.8-r0
ansible:3.11	eq	2.9.3-r0
ansible	eq	2.7.16-r0

References

bugzilla.redhat.com/show_bug.cgi?id=1802154

bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1737

github.com/ansible/ansible/commit/6a92599fb68c00a29c77312dd3843f6395115dd8

github.com/ansible/ansible/issues/67795

github.com/ansible/ansible/pull/67799

lists.fedoraproject.org/archives/list/[email protected]/message/FWDK3QUVBULS3Q3PQTGEKUQYPSNOU5M3/

lists.fedoraproject.org/archives/list/[email protected]/message/QT27K5ZRGDPCH7GT3DRI3LO4IVDVQUB7/

lists.fedoraproject.org/archives/list/[email protected]/message/U3IMV3XEIUXL6S4KPLYYM4TVJQ2VNEP2/

security.gentoo.org/glsa/202006-11

0.0004 Low

EPSS

Percentile

14.2%

JSON

Related for VERACODE:22590