PT-2020-5090 · Red Hat+2 · Ansible+2
Samdoran
·
Published
2020-03-09
·
Updated
2025-11-21
·
CVE-2020-1737
CVSS v4.0
8.5
High
| Vector | AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Ansible versions 2.7.17 and prior
Ansible versions 2.8.9 and prior
Ansible versions 2.9.6 and prior
Description
A flaw was found in Ansible when using the Extract-Zip function from the win unzip module. The extracted file(s) are not checked if they belong to the destination folder, allowing an attacker to craft an archive anywhere in the file system using a path traversal. This issue may impact the confidentiality, integrity, and availability of protected information.
Recommendations
For Ansible versions 2.7.17 and prior, update to version 2.10 or later.
For Ansible versions 2.8.9 and prior, update to version 2.10 or later.
For Ansible versions 2.9.6 and prior, update to version 2.10 or later.
As a temporary workaround, consider restricting the use of the win unzip module until a patch is available.
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Ansible
Astra Linux