Directory Traversal

2020-04-0203:39:25

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

9.9%

JSON

ansible is vulnerable to directory traversal. When extracting a collection of .tar.gz file, neither install() nor the called _extract_tar_file() performs any validation or sanitization of the filenames. This allows a malicious collection of .tar.gz file to be written in arbitrary location on the file system.

CPENameOperatorVersion
ansiblele2.9.6
ansibleeq2.6.4__1.el7ae
ansibleeq2.6.2__1.el7
ansibleeq2.2.2.0__1.el7
ansibleeq2.9.6__2.el7
ansibleeq2.6.5__1.el7ae
ansibleeq2.4.4.0__1.el7ae
ansibleeq2.7.0__1.el7ae
ansibleeq2.9.2__1.el8ae
ansibleeq2.8.1__1.el7ae

Name	Operator	Version
ansible	le	2.9.6
ansible	eq	2.6.4__1.el7ae
ansible	eq	2.6.2__1.el7
ansible	eq	2.2.2.0__1.el7
ansible	eq	2.9.6__2.el7
ansible	eq	2.6.5__1.el7ae
ansible	eq	2.4.4.0__1.el7ae
ansible	eq	2.7.0__1.el7ae
ansible	eq	2.9.2__1.el8ae
ansible	eq	2.8.1__1.el7ae